Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0982
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.262-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
},
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.180-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64376"
},
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-64275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64275"
},
{
"name": "CVE-2026-64274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64274"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64452"
},
{
"name": "CVE-2026-64483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64483"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-64409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64409"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-64489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64489"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64480"
},
{
"name": "CVE-2026-64399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64399"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-64454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64454"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2026-53400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
},
{
"name": "CVE-2026-64365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64365"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64514"
},
{
"name": "CVE-2026-64279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64279"
},
{
"name": "CVE-2026-64337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64337"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64430"
},
{
"name": "CVE-2026-64497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64497"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-64276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
},
{
"name": "CVE-2026-64475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64475"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64271"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64455"
},
{
"name": "CVE-2026-52942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52942"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-64445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64445"
},
{
"name": "CVE-2026-64500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64500"
},
{
"name": "CVE-2026-63806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
},
{
"name": "CVE-2026-64330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64330"
},
{
"name": "CVE-2026-64348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64348"
},
{
"name": "CVE-2026-64469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64469"
},
{
"name": "CVE-2026-64362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64362"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-64486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64486"
},
{
"name": "CVE-2026-64446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64446"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64338"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-64536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64536"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-64351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64351"
},
{
"name": "CVE-2026-23204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-64432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64432"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-53332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53332"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64296"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64370"
},
{
"name": "CVE-2026-43216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43216"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-64299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64299"
},
{
"name": "CVE-2026-64374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64374"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64345"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-64504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64504"
},
{
"name": "CVE-2026-64398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64398"
},
{
"name": "CVE-2026-64297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64297"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-64397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64397"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-64468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64468"
},
{
"name": "CVE-2026-64449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64449"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-63797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
},
{
"name": "CVE-2026-64456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64456"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64465"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-64442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64442"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64248"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64458"
},
{
"name": "CVE-2026-64476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64476"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-64318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64318"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-64394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64394"
},
{
"name": "CVE-2026-53177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-64435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64435"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64336"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64346"
},
{
"name": "CVE-2026-31610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31610"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-64342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64342"
},
{
"name": "CVE-2026-64360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64360"
},
{
"name": "CVE-2022-50114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50114"
},
{
"name": "CVE-2026-64478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64478"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64437"
},
{
"name": "CVE-2026-64335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64335"
},
{
"name": "CVE-2026-64301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64301"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-64395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64395"
},
{
"name": "CVE-2026-64273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64273"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2024-36013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36013"
},
{
"name": "CVE-2025-40196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40196"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-46135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46135"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-53393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
},
{
"name": "CVE-2026-64496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64496"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-64316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64316"
},
{
"name": "CVE-2026-64417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64417"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-64443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64443"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-64269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64269"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64482"
},
{
"name": "CVE-2026-64495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64495"
},
{
"name": "CVE-2026-64396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64396"
},
{
"name": "CVE-2026-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64324"
},
{
"name": "CVE-2026-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64329"
},
{
"name": "CVE-2026-64373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64373"
},
{
"name": "CVE-2026-64277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
},
{
"name": "CVE-2026-64503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64503"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-64403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64403"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-64487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64487"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-64429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64429"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-64350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64350"
},
{
"name": "CVE-2026-64250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64250"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-64448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64448"
},
{
"name": "CVE-2026-64347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64347"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2026-64393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64393"
},
{
"name": "CVE-2026-64419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64419"
},
{
"name": "CVE-2026-64372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64372"
},
{
"name": "CVE-2026-64444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64444"
},
{
"name": "CVE-2022-49803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49803"
},
{
"name": "CVE-2026-64331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64331"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64494"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64379"
},
{
"name": "CVE-2026-64420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64420"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
},
{
"name": "CVE-2026-64425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64425"
},
{
"name": "CVE-2026-64600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64600"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64505"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-64422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64422"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64484"
},
{
"name": "CVE-2026-64298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2023-52494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52494"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
},
{
"name": "CVE-2026-63829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
},
{
"name": "CVE-2026-64440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64440"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
},
{
"name": "CVE-2026-64359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64359"
},
{
"name": "CVE-2026-43219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43219"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0982",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00007",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00007.html"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00008",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00008.html"
}
]
}
CVE-2026-64371 (GCVE-0-2026-64371)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-07-25 08:50
VLAI
EPSS
VEX
Title
proc: protect ptrace_may_access() with exec_update_lock (part 1)
Summary
In the Linux kernel, the following vulnerability has been resolved:
proc: protect ptrace_may_access() with exec_update_lock (part 1)
Fix the easy cases where procfs currently calls ptrace_may_access() without
exec_update_lock protection, where the fix is to simply add the extra lock
or use mm_access():
- do_task_stat(): grab exec_update_lock
- proc_pid_wchan(): grab exec_update_lock
- proc_map_files_lookup(): use mm_access() instead of get_task_mm()
- proc_map_files_readdir(): use mm_access() instead of get_task_mm()
- proc_ns_get_link(): grab exec_update_lock
- proc_ns_readlink(): grab exec_update_lock
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f83ce3e6b02d5e48b3a43b001390e2b58820389d , < ae1e630bcaac739f625822078edbaea98366930d
(git)
Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < d54f14655fd7d7b293698a8b6918563c4c0465e7 (git) Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9 (git) Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < 7456ae990a9738962b33146916fabca62ae3d4e0 (git) Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < 4bfe8c481846cee52473a2f7d7b30ee8e6749fc4 (git) Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < f9b4b03ccc9c69bf7f7298d4559906ebea7143b3 (git) Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < c1cfd63326f5d09999134e9052c353faf738286e (git) Affected: f83ce3e6b02d5e48b3a43b001390e2b58820389d , < 6650527444dadc63d84aa939d14ecba4fadb2f69 (git) Affected: 6b06d6282100dd5aacf7d45443d651a1995bd9c4 (git) Affected: 334ed22054b2ec8477e4409e214fc139cf937ef6 (git) Affected: 2.6.27.23 , < 2.6.28 (semver) Affected: 2.6.29.3 , < 2.6.30 (semver) |
|
| Linux | Linux |
Affected:
2.6.30
Unaffected: 0 , < 2.6.30 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c",
"fs/proc/base.c",
"fs/proc/namespaces.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae1e630bcaac739f625822078edbaea98366930d",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "d54f14655fd7d7b293698a8b6918563c4c0465e7",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "7456ae990a9738962b33146916fabca62ae3d4e0",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "4bfe8c481846cee52473a2f7d7b30ee8e6749fc4",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "f9b4b03ccc9c69bf7f7298d4559906ebea7143b3",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "c1cfd63326f5d09999134e9052c353faf738286e",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "6650527444dadc63d84aa939d14ecba4fadb2f69",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"status": "affected",
"version": "6b06d6282100dd5aacf7d45443d651a1995bd9c4",
"versionType": "git"
},
{
"status": "affected",
"version": "334ed22054b2ec8477e4409e214fc139cf937ef6",
"versionType": "git"
},
{
"lessThan": "2.6.28",
"status": "affected",
"version": "2.6.27.23",
"versionType": "semver"
},
{
"lessThan": "2.6.30",
"status": "affected",
"version": "2.6.29.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c",
"fs/proc/base.c",
"fs/proc/namespaces.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.27.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.29.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: protect ptrace_may_access() with exec_update_lock (part 1)\n\nFix the easy cases where procfs currently calls ptrace_may_access() without\nexec_update_lock protection, where the fix is to simply add the extra lock\nor use mm_access():\n\n - do_task_stat(): grab exec_update_lock\n - proc_pid_wchan(): grab exec_update_lock\n - proc_map_files_lookup(): use mm_access() instead of get_task_mm()\n - proc_map_files_readdir(): use mm_access() instead of get_task_mm()\n - proc_ns_get_link(): grab exec_update_lock\n - proc_ns_readlink(): grab exec_update_lock"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:50:23.981Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d"
},
{
"url": "https://git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7"
},
{
"url": "https://git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9"
},
{
"url": "https://git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0"
},
{
"url": "https://git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4"
},
{
"url": "https://git.kernel.org/stable/c/f9b4b03ccc9c69bf7f7298d4559906ebea7143b3"
},
{
"url": "https://git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e"
},
{
"url": "https://git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69"
}
],
"title": "proc: protect ptrace_may_access() with exec_update_lock (part 1)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64371",
"datePublished": "2026-07-25T08:50:23.981Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-07-25T08:50:23.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64372 (GCVE-0-2026-64372)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).
Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 8e454e9d0bc03446d610ee49abec9dfd424f6541
(git)
Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 632666a63116d8061c62a988d1ca39dcd6d27c9b (git) Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 5cdb25f144b101083d8bf3fd023ad87fbe6850d7 (git) Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 982c9f92d57bda2b769851ff6d90d43dcf5f3734 (git) Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < a36ca93a8ba57464e521d70a337d37f069064111 (git) Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7 (git) Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29 (git) Affected: 0f1d683fb35d6c6f49ef696c95757f3970682a0e , < 266d3dd8b757b48a576e90f018b51f7b7563cc32 (git) |
|
| Linux | Linux |
Affected:
2.6.34
Unaffected: 0 , < 2.6.34 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/pcc-cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8e454e9d0bc03446d610ee49abec9dfd424f6541",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "632666a63116d8061c62a988d1ca39dcd6d27c9b",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "5cdb25f144b101083d8bf3fd023ad87fbe6850d7",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "982c9f92d57bda2b769851ff6d90d43dcf5f3734",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "a36ca93a8ba57464e521d70a337d37f069064111",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
},
{
"lessThan": "266d3dd8b757b48a576e90f018b51f7b7563cc32",
"status": "affected",
"version": "0f1d683fb35d6c6f49ef696c95757f3970682a0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/pcc-cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: pcc: fix use-after-free and double free in _OSC evaluation\n\npcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the\ntwo-phase _OSC negotiation. Between the two calls it freed\noutput.pointer but left output.length unchanged. Since\nacpi_evaluate_object() treats a non-zero length with a non-NULL\npointer as an existing buffer to write into, the second call wrote\ninto freed memory (use-after-free). The subsequent kfree(output.pointer)\nat out_free then freed the same pointer a second time (double free).\n\nReset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER\nafter freeing the first result, so ACPICA allocates a fresh buffer for\neach phase independently."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached during local initialization of the x86 PCC cpufreq driver on systems exposing the required ACPI PCC objects; no network, radio, or hot-plug input reaches this path.\nAC:L - Once two-phase _OSC negotiation succeeds, the stale-buffer write and subsequent double free occur deterministically without a race or other condition beyond attacker influence.\nPR:L - PCC platform-device creation and driver probing can occur automatically during boot or module autoload, leaving exploitable heap corruption without the attacker needing CAP_SYS_MODULE. A basic local user can groom and consume the resulting overlapping or corrupted slab objects.\nUI:N - The vulnerable driver probe and _OSC negotiation occur automatically and require no victim action.\nS:U - The corruption affects the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free and double free can produce overlapping kernel heap objects, enabling disclosure of arbitrary kernel memory.\nI:H - The freed-object write and allocator freelist corruption can enable arbitrary kernel-memory modification and control-flow hijacking.\nA:H - Hardened allocators may immediately detect the double free and stop the kernel, while other configurations can crash or panic from the corrupted slab freelist."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:10.816Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541"
},
{
"url": "https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b"
},
{
"url": "https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7"
},
{
"url": "https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734"
},
{
"url": "https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111"
},
{
"url": "https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7"
},
{
"url": "https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29"
},
{
"url": "https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32"
}
],
"title": "cpufreq: pcc: fix use-after-free and double free in _OSC evaluation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64372",
"datePublished": "2026-07-25T08:50:24.733Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-05T12:41:10.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64373 (GCVE-0-2026-64373)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-07-25 08:50
VLAI
EPSS
VEX
Title
cpufreq: Fix hotplug-suspend race during reboot
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: Fix hotplug-suspend race during reboot
During system reboot, cpufreq_suspend() is called via the
kernel_restart() -> device_shutdown() path. Unlike the normal system
suspend path, the reboot path does not call freeze_processes(), so
userspace processes and kernel threads remain active.
This allows CPU hotplug operations to run concurrently with
cpufreq_suspend(). The original code has no synchronization with CPU
hotplug, leading to a race condition where governor_data can be freed
by the hotplug path while cpufreq_suspend() is still accessing it,
resulting in a null pointer dereference:
Unable to handle kernel NULL pointer dereference
Call Trace:
do_kernel_fault+0x28/0x3c
cpufreq_suspend+0xdc/0x160
device_shutdown+0x18/0x200
kernel_restart+0x40/0x80
arm64_sys_reboot+0x1b0/0x200
Fix this by adding cpus_read_lock()/cpus_read_unlock() to
cpufreq_suspend() to block CPU hotplug operations while suspend is in
progress.
[ rjw: Changelog edits ]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < 6d5dd354c37abaf4d60400c55c71f23ba2b33639
(git)
Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < 9103078c7b3091a2fbb52af176f95982ee7dd7f8 (git) Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < cd4524ff6567fa4458a5bec4b017105e671d393e (git) Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < 73255d702c7560185fd5951aadcf7eb057c2f453 (git) Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < a0ef2fc89d28ca62923376c4b8ffaa57136a36be (git) Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < 6e175c00c62dca3d91b987015808b5d52e8db2b4 (git) Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < a0106b41f9a724868d390b8b3b4ea5ca0e04ea53 (git) Affected: 65650b35133ff20f0c9ef0abd5c3c66dbce3ae57 , < a9029dd55696c651ee46912afa2a166fa456bb3e (git) Affected: 8bfa06ea6e81bf08d2132d7e70c2b5313b34caf8 (git) Affected: 7ccf3b8b7a12dc9da158c2e699c36d04b2496944 (git) Affected: 5f466713989250938624afa79dc33bae20920700 (git) Affected: 89ab39da1452d272007acc5912d4008047b86706 (git) Affected: cb4b4601f910c78d2b49f637a12ef98b41cb76a9 (git) Affected: 4.4.198 , < 4.5 (semver) Affected: 4.9.198 , < 4.10 (semver) Affected: 4.14.151 , < 4.15 (semver) Affected: 4.19.81 , < 4.20 (semver) Affected: 5.3.8 , < 5.4 (semver) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d5dd354c37abaf4d60400c55c71f23ba2b33639",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "9103078c7b3091a2fbb52af176f95982ee7dd7f8",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "cd4524ff6567fa4458a5bec4b017105e671d393e",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "73255d702c7560185fd5951aadcf7eb057c2f453",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "a0ef2fc89d28ca62923376c4b8ffaa57136a36be",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "6e175c00c62dca3d91b987015808b5d52e8db2b4",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "a0106b41f9a724868d390b8b3b4ea5ca0e04ea53",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"lessThan": "a9029dd55696c651ee46912afa2a166fa456bb3e",
"status": "affected",
"version": "65650b35133ff20f0c9ef0abd5c3c66dbce3ae57",
"versionType": "git"
},
{
"status": "affected",
"version": "8bfa06ea6e81bf08d2132d7e70c2b5313b34caf8",
"versionType": "git"
},
{
"status": "affected",
"version": "7ccf3b8b7a12dc9da158c2e699c36d04b2496944",
"versionType": "git"
},
{
"status": "affected",
"version": "5f466713989250938624afa79dc33bae20920700",
"versionType": "git"
},
{
"status": "affected",
"version": "89ab39da1452d272007acc5912d4008047b86706",
"versionType": "git"
},
{
"status": "affected",
"version": "cb4b4601f910c78d2b49f637a12ef98b41cb76a9",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.198",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.198",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.151",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.81",
"versionType": "semver"
},
{
"lessThan": "5.4",
"status": "affected",
"version": "5.3.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.198",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.198",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: Fix hotplug-suspend race during reboot\n\nDuring system reboot, cpufreq_suspend() is called via the\nkernel_restart() -\u003e device_shutdown() path. Unlike the normal system\nsuspend path, the reboot path does not call freeze_processes(), so\nuserspace processes and kernel threads remain active.\n\nThis allows CPU hotplug operations to run concurrently with\ncpufreq_suspend(). The original code has no synchronization with CPU\nhotplug, leading to a race condition where governor_data can be freed\nby the hotplug path while cpufreq_suspend() is still accessing it,\nresulting in a null pointer dereference:\n\n Unable to handle kernel NULL pointer dereference\n Call Trace:\n do_kernel_fault+0x28/0x3c\n cpufreq_suspend+0xdc/0x160\n device_shutdown+0x18/0x200\n kernel_restart+0x40/0x80\n arm64_sys_reboot+0x1b0/0x200\n\nFix this by adding cpus_read_lock()/cpus_read_unlock() to\ncpufreq_suspend() to block CPU hotplug operations while suspend is in\nprogress.\n\n[ rjw: Changelog edits ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:50:25.427Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639"
},
{
"url": "https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8"
},
{
"url": "https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e"
},
{
"url": "https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453"
},
{
"url": "https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be"
},
{
"url": "https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4"
},
{
"url": "https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53"
},
{
"url": "https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e"
}
],
"title": "cpufreq: Fix hotplug-suspend race during reboot",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64373",
"datePublished": "2026-07-25T08:50:25.427Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-07-25T08:50:25.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64374 (GCVE-0-2026-64374)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
RT migration is done aggressively. When a CPU schedules out a high
priority RT task for a lower priority task, it will look to see if there's
any RT tasks that are waiting to run on another CPU that is of higher
priority than the task this CPU is about to run. If it finds one, it will
pull that task over to the CPU and allow it to run there instead.
Normally, this pulling is done by looking at the RT overloaded mask (rto)
which contains all the CPUs in the scheduler domain with RT tasks that are
waiting to run due to a higher priority RT task currently running on their
CPU. The CPU that is about to schedule a lower priority task will grab the
rq lock of the overloaded CPU and move the RT task from that CPU's runqueue
to the local one and schedule the higher priority RT task.
This caused issues when a lot of CPUs would schedule a lower priority task
at the same time. They would all try to grab the same runqueue lock of
the CPU with the overloaded RT tasks. Only the first CPU that got in will
get that task. All the others would wait until they got the runqueue lock
and see there's nothing to pull and do nothing. On systems with lots of
CPUs, this caused a large latency (up to 500us) which is beyond what
PREEMPT_RT is to allow.
The solution to that was to create an RT_PUSH_IPI logic. When any CPU
wanted to pull a task, instead of grabbing the runqueue lock of the
overloaded CPU, it would start by sending an IPI to the overloaded CPU,
and that IPI handler would have the CPU with the waiting RT task do a push
instead. Then that handler would send an IPI to the next CPU with
overloaded RT tasks, and so on. Note, after the first CPU starts this
process, if another CPU wanted to do a pull, it would see that the process
has already begun and would only increment a counter to have the IPIs
continue again.
The RT_PUSH_IPI solved the latency problem with PREEMPT_RT but could cause
a new issue with non PREEMPT_RT. Namely, softirqs run in a threaded
context on PREEMPT_RT but they can run in an interrupt context in non-RT.
If an IPI lands on a CPU that has just woken up multiple RT tasks and the
current CPU is running a non RT or a low priority RT task, instead of
doing a push, it would simply do a schedule on that CPU. But if a softirq
was also executing on this CPU, the schedule would need to wait until the
softirq finished. Until then, the CPU would still be considered overloaded
as there are RT tasks still waiting to run on it.
A live lock occurred on a workload that was doing heavy networking traffic
on a large machine where the softirqs would run 500us out of 750us. And it
would also be waking up RT tasks, causing the RT pull logic to be
constantly executed.
When a softirq triggered on a CPU with RT tasks queued but not running
yet, and the other CPUs would see this CPU as being overloaded, they would
send an IPI over to it. The CPU would notice that the waiting RT tasks are
of higher priority than the currently running task and simply schedule
that CPU instead. But because the softirq was executing, before it could
schedule, it would receive another IPI to do the same. The amount of IPIs
would slow down the currently running softirq so much that before it could
return back to task context, it would execute another softirq never
allowing the CPU to schedule. This live locked that CPU.
As RT_PUSH_IPI was created to help PREEMPT_RT, make it default off if
PREEMPT_RT is not enabled.
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b6366f048e0caff28af5335b7af2031266e1b06b , < b99f04ae3d200d2f8844aa29145bd18eccbeecde
(git)
Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < d8312a56d9a162e3ec76476aa487e7d20bc602e9 (git) Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < 44aae426dbfd51286f7eb601cfa14bc32164812a (git) Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < 860aaff72c8446fed5e576249e19952883a18885 (git) Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < 89237c8fc15d8016a194076e648ccb57d75e65ae (git) Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < 4bd0da48fbc1dbef6774175129107fbbdd353e26 (git) Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < a18f80bf5359238c4f067d691b96af00286fdd89 (git) Affected: b6366f048e0caff28af5335b7af2031266e1b06b , < dd29c017aed628076e915fe4cdfb5392fd4c5cab (git) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/features.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b99f04ae3d200d2f8844aa29145bd18eccbeecde",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "d8312a56d9a162e3ec76476aa487e7d20bc602e9",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "44aae426dbfd51286f7eb601cfa14bc32164812a",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "860aaff72c8446fed5e576249e19952883a18885",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "89237c8fc15d8016a194076e648ccb57d75e65ae",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "4bd0da48fbc1dbef6774175129107fbbdd353e26",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "a18f80bf5359238c4f067d691b96af00286fdd89",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
},
{
"lessThan": "dd29c017aed628076e915fe4cdfb5392fd4c5cab",
"status": "affected",
"version": "b6366f048e0caff28af5335b7af2031266e1b06b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/features.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT\n\nRT migration is done aggressively. When a CPU schedules out a high\npriority RT task for a lower priority task, it will look to see if there\u0027s\nany RT tasks that are waiting to run on another CPU that is of higher\npriority than the task this CPU is about to run. If it finds one, it will\npull that task over to the CPU and allow it to run there instead.\n\nNormally, this pulling is done by looking at the RT overloaded mask (rto)\nwhich contains all the CPUs in the scheduler domain with RT tasks that are\nwaiting to run due to a higher priority RT task currently running on their\nCPU. The CPU that is about to schedule a lower priority task will grab the\nrq lock of the overloaded CPU and move the RT task from that CPU\u0027s runqueue\nto the local one and schedule the higher priority RT task.\n\nThis caused issues when a lot of CPUs would schedule a lower priority task\nat the same time. They would all try to grab the same runqueue lock of\nthe CPU with the overloaded RT tasks. Only the first CPU that got in will\nget that task. All the others would wait until they got the runqueue lock\nand see there\u0027s nothing to pull and do nothing. On systems with lots of\nCPUs, this caused a large latency (up to 500us) which is beyond what\nPREEMPT_RT is to allow.\n\nThe solution to that was to create an RT_PUSH_IPI logic. When any CPU\nwanted to pull a task, instead of grabbing the runqueue lock of the\noverloaded CPU, it would start by sending an IPI to the overloaded CPU,\nand that IPI handler would have the CPU with the waiting RT task do a push\ninstead. Then that handler would send an IPI to the next CPU with\noverloaded RT tasks, and so on. Note, after the first CPU starts this\nprocess, if another CPU wanted to do a pull, it would see that the process\nhas already begun and would only increment a counter to have the IPIs\ncontinue again.\n\nThe RT_PUSH_IPI solved the latency problem with PREEMPT_RT but could cause\na new issue with non PREEMPT_RT. Namely, softirqs run in a threaded\ncontext on PREEMPT_RT but they can run in an interrupt context in non-RT.\n\nIf an IPI lands on a CPU that has just woken up multiple RT tasks and the\ncurrent CPU is running a non RT or a low priority RT task, instead of\ndoing a push, it would simply do a schedule on that CPU. But if a softirq\nwas also executing on this CPU, the schedule would need to wait until the\nsoftirq finished. Until then, the CPU would still be considered overloaded\nas there are RT tasks still waiting to run on it.\n\nA live lock occurred on a workload that was doing heavy networking traffic\non a large machine where the softirqs would run 500us out of 750us. And it\nwould also be waking up RT tasks, causing the RT pull logic to be\nconstantly executed.\n\nWhen a softirq triggered on a CPU with RT tasks queued but not running\nyet, and the other CPUs would see this CPU as being overloaded, they would\nsend an IPI over to it. The CPU would notice that the waiting RT tasks are\nof higher priority than the currently running task and simply schedule\nthat CPU instead. But because the softirq was executing, before it could\nschedule, it would receive another IPI to do the same. The amount of IPIs\nwould slow down the currently running softirq so much that before it could\nreturn back to task context, it would execute another softirq never\nallowing the CPU to schedule. This live locked that CPU.\n\nAs RT_PUSH_IPI was created to help PREEMPT_RT, make it default off if\nPREEMPT_RT is not enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Unauthenticated inbound network traffic can sustain NET_RX softirq processing and trigger the scheduler livelock on a vulnerable non-PREEMPT_RT SMP host with ordinary kernel RT threads.\nAC:L - Sustained traffic overlapping recurring RT-thread wakeups is sufficient; upstream observed reliable production lockups at only 30\u201340% CPU utilization, without a precise race win or memory-layout requirement.\nPR:N - The remote sender requires no account, capability, or protocol authentication because packet reception precedes such checks and the required RT tasks can be created by existing kernel drivers and system services.\nUI:N - No victim action is required once the affected host is running its normal workload; the attacker can maintain the triggering packet stream independently.\nS:U - The livelock affects availability within the vulnerable host kernel\u0027s existing security authority and does not cross a VM, sandbox, or hardware-isolation boundary.\nC:N - The defect causes an IPI scheduling loop without an out-of-bounds access, use-after-free, uninitialized read, or other information-disclosure mechanism.\nI:N - The vulnerable path does not corrupt memory or provide a write primitive, data modification, or control-flow influence.\nA:H - The repeated push IPIs can livelock a CPU, produce a soft lockup, indefinitely stall workloads, and potentially cause a watchdog panic or whole-host denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:11.896Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b99f04ae3d200d2f8844aa29145bd18eccbeecde"
},
{
"url": "https://git.kernel.org/stable/c/d8312a56d9a162e3ec76476aa487e7d20bc602e9"
},
{
"url": "https://git.kernel.org/stable/c/44aae426dbfd51286f7eb601cfa14bc32164812a"
},
{
"url": "https://git.kernel.org/stable/c/860aaff72c8446fed5e576249e19952883a18885"
},
{
"url": "https://git.kernel.org/stable/c/89237c8fc15d8016a194076e648ccb57d75e65ae"
},
{
"url": "https://git.kernel.org/stable/c/4bd0da48fbc1dbef6774175129107fbbdd353e26"
},
{
"url": "https://git.kernel.org/stable/c/a18f80bf5359238c4f067d691b96af00286fdd89"
},
{
"url": "https://git.kernel.org/stable/c/dd29c017aed628076e915fe4cdfb5392fd4c5cab"
}
],
"title": "sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64374",
"datePublished": "2026-07-25T08:50:26.130Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-05T12:41:11.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64375 (GCVE-0-2026-64375)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
proc: protect ptrace_may_access() with exec_update_lock (FD links)
Summary
In the Linux kernel, the following vulnerability has been resolved:
proc: protect ptrace_may_access() with exec_update_lock (FD links)
proc_pid_get_link() and proc_pid_readlink() currently look up the task from
the pid once, then do the ptrace access check on that task, then look up
the task from the pid a second time to do the actual access.
That's racy in several ways.
To fix it, pass the task to the ->proc_get_link() handler, and instead of
proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that
looks up and locks the task, does the access check, and calls
->proc_get_link().
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
778c1144771f0064b6f51bee865cceb0d996f2f9 , < 6253dfee5afba536bb54fc6fe6c091c3758fafe1
(git)
Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < 65bf0d2b6e914f1448d6a2fde193dcf60936a651 (git) Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf (git) Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < 138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2 (git) Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < 83b17872e3166c295c599279fc9562ac3840c638 (git) Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < 497c6bae5167428596575f20af6613ff5671f383 (git) Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < dfd1894cb64cbd8758b461ed713800fe73db4f82 (git) Affected: 778c1144771f0064b6f51bee865cceb0d996f2f9 , < 6255da28d4bb5349fe18e84cb043ccd394eba75d (git) |
|
| Linux | Linux |
Affected:
2.6.18
Unaffected: 0 , < 2.6.18 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/proc/base.c",
"fs/proc/fd.c",
"fs/proc/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6253dfee5afba536bb54fc6fe6c091c3758fafe1",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "65bf0d2b6e914f1448d6a2fde193dcf60936a651",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "83b17872e3166c295c599279fc9562ac3840c638",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "497c6bae5167428596575f20af6613ff5671f383",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "dfd1894cb64cbd8758b461ed713800fe73db4f82",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "6255da28d4bb5349fe18e84cb043ccd394eba75d",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/proc/base.c",
"fs/proc/fd.c",
"fs/proc/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: protect ptrace_may_access() with exec_update_lock (FD links)\n\nproc_pid_get_link() and proc_pid_readlink() currently look up the task from\nthe pid once, then do the ptrace access check on that task, then look up\nthe task from the pid a second time to do the actual access.\nThat\u0027s racy in several ways.\n\nTo fix it, pass the task to the -\u003eproc_get_link() handler, and instead of\nproc_fd_access_allowed(), introduce a new helper call_proc_get_link() that\nlooks up and locks the task, does the access check, and calls\n-\u003eproc_get_link()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation uses local open/openat or readlink syscalls against /proc/$pid symlinks; no network or physical access path reaches the flaw.\nAC:L - The attacker can launch the setuid target process and race concurrent procfs accesses repeatedly, thereby controlling both sides of the race.\nPR:L - A basic unprivileged user can pass the initial ptrace check against a same-UID dumpable child before it performs privileged exec; no capability is required.\nUI:N - The attacker can create and race the target by launching the setuid program directly, without action from another user.\nS:U - The procfs authorization bypass compromises privileged resources on the same host and constitutes ordinary local privilege escalation rather than crossing a VM or hardware isolation boundary.\nC:H - The race can redirect an authorized pre-exec lookup to a private post-setuid memfd whose permissive shmem inode allows the attacker to read all privileged contents, including secrets.\nI:H - The attacker can obtain write and truncation access to the privileged memfd; corruption of trusted data or executable content consumed by the setuid process can yield root-level code execution.\nA:H - Tampering with a privileged process\u0027s trusted memfd can crash or disable critical privileged services, and resulting root-level execution permits complete system availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:12.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6253dfee5afba536bb54fc6fe6c091c3758fafe1"
},
{
"url": "https://git.kernel.org/stable/c/65bf0d2b6e914f1448d6a2fde193dcf60936a651"
},
{
"url": "https://git.kernel.org/stable/c/de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf"
},
{
"url": "https://git.kernel.org/stable/c/138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2"
},
{
"url": "https://git.kernel.org/stable/c/83b17872e3166c295c599279fc9562ac3840c638"
},
{
"url": "https://git.kernel.org/stable/c/497c6bae5167428596575f20af6613ff5671f383"
},
{
"url": "https://git.kernel.org/stable/c/dfd1894cb64cbd8758b461ed713800fe73db4f82"
},
{
"url": "https://git.kernel.org/stable/c/6255da28d4bb5349fe18e84cb043ccd394eba75d"
}
],
"title": "proc: protect ptrace_may_access() with exec_update_lock (FD links)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64375",
"datePublished": "2026-07-25T08:50:26.869Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-05T12:41:12.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64376 (GCVE-0-2026-64376)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-07-25 08:50
VLAI
EPSS
VEX
Title
firmware_loader: fix device reference leak in firmware_upload_register()
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware_loader: fix device reference leak in firmware_upload_register()
firmware_upload_register()
-> fw_create_instance()
-> device_initialize()
After fw_create_instance() succeeds, the lifetime of the embedded struct
device is expected to be managed through the device core reference
counting, since fw_create_instance() has already called
device_initialize().
In firmware_upload_register(), if alloc_lookup_fw_priv() fails after
fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees
fw_sysfs directly instead of releasing the device reference with
put_device(). This may leave the reference count of the embedded struct
device unbalanced, resulting in a refcount leak.
The issue was identified by a static analysis tool I developed and
confirmed by manual review. Fix this by using put_device(fw_dev) in the
failure path and letting fw_dev_release() handle the final cleanup,
instead of freeing the instance directly from the error path.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
97730bbb242cde22b7140acd202ffd88823886c9 , < 517676ec7dfca064e08f94007a4abd21969de0a0
(git)
Affected: 97730bbb242cde22b7140acd202ffd88823886c9 , < 46d403da376a8b7c1187193294953816e1a8d7fe (git) Affected: 97730bbb242cde22b7140acd202ffd88823886c9 , < 2619b47a0c8114eef980a56ade7e3ef4b58eb384 (git) Affected: 97730bbb242cde22b7140acd202ffd88823886c9 , < 92f41769e5fd16bcd9ba97500d0517332e0a5b45 (git) Affected: 97730bbb242cde22b7140acd202ffd88823886c9 , < 15432f19562fdb9199cce6d9fc24db12c71ed574 (git) Affected: 97730bbb242cde22b7140acd202ffd88823886c9 , < 896df22ee57648b0c505bd76ddbc6b2341834696 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/firmware_loader/sysfs_upload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "517676ec7dfca064e08f94007a4abd21969de0a0",
"status": "affected",
"version": "97730bbb242cde22b7140acd202ffd88823886c9",
"versionType": "git"
},
{
"lessThan": "46d403da376a8b7c1187193294953816e1a8d7fe",
"status": "affected",
"version": "97730bbb242cde22b7140acd202ffd88823886c9",
"versionType": "git"
},
{
"lessThan": "2619b47a0c8114eef980a56ade7e3ef4b58eb384",
"status": "affected",
"version": "97730bbb242cde22b7140acd202ffd88823886c9",
"versionType": "git"
},
{
"lessThan": "92f41769e5fd16bcd9ba97500d0517332e0a5b45",
"status": "affected",
"version": "97730bbb242cde22b7140acd202ffd88823886c9",
"versionType": "git"
},
{
"lessThan": "15432f19562fdb9199cce6d9fc24db12c71ed574",
"status": "affected",
"version": "97730bbb242cde22b7140acd202ffd88823886c9",
"versionType": "git"
},
{
"lessThan": "896df22ee57648b0c505bd76ddbc6b2341834696",
"status": "affected",
"version": "97730bbb242cde22b7140acd202ffd88823886c9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/firmware_loader/sysfs_upload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: fix device reference leak in firmware_upload_register()\n\nfirmware_upload_register()\n -\u003e fw_create_instance()\n -\u003e device_initialize()\n\nAfter fw_create_instance() succeeds, the lifetime of the embedded struct\ndevice is expected to be managed through the device core reference\ncounting, since fw_create_instance() has already called\ndevice_initialize().\n\nIn firmware_upload_register(), if alloc_lookup_fw_priv() fails after\nfw_create_instance() succeeds, the code reaches free_fw_sysfs and frees\nfw_sysfs directly instead of releasing the device reference with\nput_device(). This may leave the reference count of the embedded struct\ndevice unbalanced, resulting in a refcount leak.\n\nThe issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix this by using put_device(fw_dev) in the\nfailure path and letting fw_dev_release() handle the final cleanup,\ninstead of freeing the instance directly from the error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:50:27.577Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/517676ec7dfca064e08f94007a4abd21969de0a0"
},
{
"url": "https://git.kernel.org/stable/c/46d403da376a8b7c1187193294953816e1a8d7fe"
},
{
"url": "https://git.kernel.org/stable/c/2619b47a0c8114eef980a56ade7e3ef4b58eb384"
},
{
"url": "https://git.kernel.org/stable/c/92f41769e5fd16bcd9ba97500d0517332e0a5b45"
},
{
"url": "https://git.kernel.org/stable/c/15432f19562fdb9199cce6d9fc24db12c71ed574"
},
{
"url": "https://git.kernel.org/stable/c/896df22ee57648b0c505bd76ddbc6b2341834696"
}
],
"title": "firmware_loader: fix device reference leak in firmware_upload_register()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64376",
"datePublished": "2026-07-25T08:50:27.577Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-07-25T08:50:27.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64378 (GCVE-0-2026-64378)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
Summary
In the Linux kernel, the following vulnerability has been resolved:
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
When a container exits, the following BUG_ON() is occasionally triggered:
==================================================================
VFS: Busy inodes after unmount of sdb (ext4)
------------[ cut here ]------------
kernel BUG at fs/super.c:695!
CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1
pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : generic_shutdown_super+0xf0/0x100
lr : generic_shutdown_super+0xf0/0x100
Call trace:
generic_shutdown_super+0xf0/0x100
kill_block_super+0x20/0x48
ext4_kill_sb+0x28/0x60
deactivate_locked_super+0x54/0x130
deactivate_super+0x84/0xa0
cleanup_mnt+0xa4/0x140
__cleanup_mnt+0x18/0x28
task_work_run+0x78/0xe0
do_notify_resume+0x204/0x240
==================================================================
The root cause is a race between cgroup_writeback_umount() and
inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between
inode_prepare_wbs_switch() returning true and the subsequent
wb_queue_isw() call. Following is the process that triggers the issue:
CPU A (umount) | CPU B (writeback)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
inode_switch_wbs/cleanup_offline_cgwb
atomic_inc(&isw_nr_in_flight)
inode_prepare_wbs_switch
-> passes SB_ACTIVE check
__iget(inode)
generic_shutdown_super
sb->s_flags &= ~SB_ACTIVE
cgroup_writeback_umount(sb)
smp_mb()
atomic_read(&isw_nr_in_flight)
rcu_barrier()
-> no pending RCU callbacks
flush_workqueue(isw_wq)
-> nothing queued, returns
evict_inodes(sb)
-> Inode skipped as isw still holds a ref.
sop->put_super(sb)
/* destroys percpu counters */
-> VFS: Busy inodes after unmount!
wb_queue_isw()
queue_work(isw_wq, ...)
/* later in work function */
inode_switch_wbs_work_fn
process_inode_switch_wbs
iput() -> evict
percpu_counter_dec() // UAF!
Fix this by extending the RCU read-side critical section in
inode_switch_wbs() and cleanup_offline_cgwb() to cover from
inode_prepare_wbs_switch() through wb_queue_isw(). Since there is
no sleep in this window, rcu_read_lock() can be used. Then add a
synchronize_rcu() in cgroup_writeback_umount() before the existing
rcu_barrier(), so that all in-flight switchers that have passed the
SB_ACTIVE check have completed queue_work() before flush_workqueue()
is called.
The existing rcu_barrier() is intentionally retained so this fix can
be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that
still queue switches via queue_rcu_work(). It is a no-op on current
mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on
wb->list_lock when switching inodes")) and is removed in a follow-up
patch.
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a1a0e23e49037c23ea84bc8cc146a03584d13577 , < 087d5b8b501c570f84bf655164e6698c3ce146e0
(git)
Affected: a1a0e23e49037c23ea84bc8cc146a03584d13577 , < 3c9c9648f77e4d14e50676bc51c2174ba9c8d361 (git) Affected: a1a0e23e49037c23ea84bc8cc146a03584d13577 , < 5c3265f3252b2ee50707adaaa3f9bd0df3df72de (git) Affected: a1a0e23e49037c23ea84bc8cc146a03584d13577 , < c923cc3cb5cd8945ceaf08252754110643446593 (git) Affected: a1a0e23e49037c23ea84bc8cc146a03584d13577 , < 685fc15a410885b6d4dee64de0dce721b9428b12 (git) Affected: a1a0e23e49037c23ea84bc8cc146a03584d13577 , < 53eeaf4d63068dbc7708b0c7adb20151c812feca (git) Affected: a1a0e23e49037c23ea84bc8cc146a03584d13577 , < cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d (git) Affected: c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339 (git) Affected: 4.4.5 , < 4.5 (semver) |
|
| Linux | Linux |
Affected:
4.5
Unaffected: 0 , < 4.5 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fs-writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "087d5b8b501c570f84bf655164e6698c3ce146e0",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "3c9c9648f77e4d14e50676bc51c2174ba9c8d361",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "5c3265f3252b2ee50707adaaa3f9bd0df3df72de",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "c923cc3cb5cd8945ceaf08252754110643446593",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "685fc15a410885b6d4dee64de0dce721b9428b12",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "53eeaf4d63068dbc7708b0c7adb20151c812feca",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"status": "affected",
"version": "c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fs-writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: fix race between cgroup_writeback_umount() and inode_switch_wbs()\n\nWhen a container exits, the following BUG_ON() is occasionally triggered:\n\n==================================================================\n VFS: Busy inodes after unmount of sdb (ext4)\n ------------[ cut here ]------------\n kernel BUG at fs/super.c:695!\n CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1\n pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : generic_shutdown_super+0xf0/0x100\n lr : generic_shutdown_super+0xf0/0x100\n Call trace:\n generic_shutdown_super+0xf0/0x100\n kill_block_super+0x20/0x48\n ext4_kill_sb+0x28/0x60\n deactivate_locked_super+0x54/0x130\n deactivate_super+0x84/0xa0\n cleanup_mnt+0xa4/0x140\n __cleanup_mnt+0x18/0x28\n task_work_run+0x78/0xe0\n do_notify_resume+0x204/0x240\n==================================================================\n\nThe root cause is a race between cgroup_writeback_umount() and\ninode_switch_wbs()/cleanup_offline_cgwb(). There is a window between\ninode_prepare_wbs_switch() returning true and the subsequent\nwb_queue_isw() call. Following is the process that triggers the issue:\n\n CPU A (umount) | CPU B (writeback)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n inode_switch_wbs/cleanup_offline_cgwb\n atomic_inc(\u0026isw_nr_in_flight)\n inode_prepare_wbs_switch\n -\u003e passes SB_ACTIVE check\n __iget(inode)\n generic_shutdown_super\n sb-\u003es_flags \u0026= ~SB_ACTIVE\n cgroup_writeback_umount(sb)\n smp_mb()\n atomic_read(\u0026isw_nr_in_flight)\n rcu_barrier()\n -\u003e no pending RCU callbacks\n flush_workqueue(isw_wq)\n -\u003e nothing queued, returns\n evict_inodes(sb)\n -\u003e Inode skipped as isw still holds a ref.\n sop-\u003eput_super(sb)\n /* destroys percpu counters */\n -\u003e VFS: Busy inodes after unmount!\n wb_queue_isw()\n queue_work(isw_wq, ...)\n /* later in work function */\n inode_switch_wbs_work_fn\n process_inode_switch_wbs\n iput() -\u003e evict\n percpu_counter_dec() // UAF!\n\nFix this by extending the RCU read-side critical section in\ninode_switch_wbs() and cleanup_offline_cgwb() to cover from\ninode_prepare_wbs_switch() through wb_queue_isw(). Since there is\nno sleep in this window, rcu_read_lock() can be used. Then add a\nsynchronize_rcu() in cgroup_writeback_umount() before the existing\nrcu_barrier(), so that all in-flight switchers that have passed the\nSB_ACTIVE check have completed queue_work() before flush_workqueue()\nis called.\n\nThe existing rcu_barrier() is intentionally retained so this fix can\nbe backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that\nstill queue switches via queue_rcu_work(). It is a no-op on current\nmainline (since commit e1b849cfa6b6 (\"writeback: Avoid contention on\nwb-\u003elist_lock when switching inodes\")) and is removed in a follow-up\npatch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through local filesystem writes, cgroup teardown, and mount-namespace or filesystem unmount paths; no network protocol directly reaches the race.\nAC:L - An attacker can churn cgroup writeback switches while repeatedly triggering container or mount teardown, controlling both racing activities and amplifying the timing window.\nPR:L - A basic local or container user can dirty writable files and initiate its own cgroup or namespace teardown; lifecycle infrastructure can perform the privileged final unmount automatically.\nUI:N - The attacker can generate the writeback state and trigger teardown without requiring another user to perform an action.\nS:U - The resulting corruption affects the same host kernel security authority and does not inherently cross a VM or hardware isolation boundary.\nC:H - The delayed worker can access superblock-private state after it and its per-CPU counters have been freed, creating an exploitable use-after-free capable of exposing arbitrary kernel memory.\nI:H - The freed superblock and per-CPU counter pointers are subsequently dereferenced and modified, potentially providing attacker-influenced kernel writes and control-flow hijacking.\nA:H - The race demonstrably triggers the busy-inode BUG_ON, and configurations continuing past that check encounter a use-after-free capable of causing an oops or kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:14.047Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0"
},
{
"url": "https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361"
},
{
"url": "https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de"
},
{
"url": "https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593"
},
{
"url": "https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12"
},
{
"url": "https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca"
},
{
"url": "https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d"
}
],
"title": "writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64378",
"datePublished": "2026-07-25T08:50:29.006Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-05T12:41:14.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64379 (GCVE-0-2026-64379)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
smb: client: mask server-provided mode to 07777 in modefromsid
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: mask server-provided mode to 07777 in modefromsid
When modefromsid is active, parse_dacl() applies the server-provided
sub_auth[2] value from the NFS mode SID to cf_mode without masking to
07777. Apply the correct masking, same as in the read path.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f8fbfb8d09c06decde162090fac3ee220aa280 , < 5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14
(git)
Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < ee2216dbdf0c677e89bb43e03247dba590ed00ef (git) Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < f511807feee7cb29b61bdfa86472c7e9e2e5df94 (git) Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < 08c600b7e1818539ba5efee4cdb06215c245ca78 (git) Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d (git) Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < c6c484a7d5bff6b929a86d7ed5130f29834c6a0d (git) Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < f80add1bfb3425100a325b14f19648e75669a954 (git) Affected: e2f8fbfb8d09c06decde162090fac3ee220aa280 , < e3d9c7160d483fc8f9e225aafad8ecbbc43f3151 (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifsacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "ee2216dbdf0c677e89bb43e03247dba590ed00ef",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "f511807feee7cb29b61bdfa86472c7e9e2e5df94",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "08c600b7e1818539ba5efee4cdb06215c245ca78",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "c6c484a7d5bff6b929a86d7ed5130f29834c6a0d",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "f80add1bfb3425100a325b14f19648e75669a954",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
},
{
"lessThan": "e3d9c7160d483fc8f9e225aafad8ecbbc43f3151",
"status": "affected",
"version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifsacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: mask server-provided mode to 07777 in modefromsid\n\nWhen modefromsid is active, parse_dacl() applies the server-provided\nsub_auth[2] value from the NFS mode SID to cf_mode without masking to\n07777. Apply the correct masking, same as in the read path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised SMB server can supply the crafted NFS mode SID through a network-delivered QUERY_INFO security descriptor.\nAC:L - With modefromsid enabled, the server directly controls sub_auth[2], and the invalid inode-type bits are applied deterministically without a race or memory-layout dependency.\nPR:N - The attacker acting as the SMB server needs no privileges on the client; client authentication to the share is a victim-side condition rather than an attacker privilege.\nUI:R - A victim administrator or service must mount the SMB share with modefromsid, or subsequently access a crafted object on an existing mount.\nS:U - The corrupted mode and resulting VFS behavior remain within the Linux kernel\u0027s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:N - The flaw only injects bits into the 16-bit mode field and provides no out-of-bounds read, memory disclosure, or direct mechanism for returning client data to the attacker.\nI:L - The attacker can alter S_IFMT bits in cf_mode and thereby change the inode\u0027s perceived type and selected VFS operations, but this is a constrained metadata modification rather than an arbitrary write or control-flow primitive.\nA:H - Forging the root or widespread inode types can prevent the share from mounting or render its objects unusable; for CIFS-root or critical SMB-backed deployments this can cause complete service availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:15.121Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14"
},
{
"url": "https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef"
},
{
"url": "https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94"
},
{
"url": "https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78"
},
{
"url": "https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d"
},
{
"url": "https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d"
},
{
"url": "https://git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954"
},
{
"url": "https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151"
}
],
"title": "smb: client: mask server-provided mode to 07777 in modefromsid",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64379",
"datePublished": "2026-07-25T08:50:29.717Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-05T12:41:15.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64380 (GCVE-0-2026-64380)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
smb: client: harden POSIX SID length parsing
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden POSIX SID length parsing
posix_info_sid_size() reads sid[1] to obtain the subauthority count,
but its existing boundary check still accepts buffers with only one
remaining byte. Require two bytes before reading sid[1] so all client
paths that reuse the helper reject truncated POSIX SIDs safely.
Severity
8.2 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
349e13ad30b45998bb9937cfe0b32be6f951976d , < 171605aed68380c2fa75dff9b3a1ed427c50065b
(git)
Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 4213c1208978483021d7d125c131de3985d38f61 (git) Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 96e889bc1e759c83f25093e8c2f3da31b4973f30 (git) Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 0de5b8e76847f5de26f364a82c6602c4881c30da (git) Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 427eb7eb46425fec845a43e861f3d6e2899cae59 (git) Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 86c5d470f5d42e61123b2f4b4f0b91f4eee5b980 (git) Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 46a84715a015cb48e1b9c219dc88c03d8a541ea4 (git) Affected: 349e13ad30b45998bb9937cfe0b32be6f951976d , < 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 (git) |
|
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "171605aed68380c2fa75dff9b3a1ed427c50065b",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "4213c1208978483021d7d125c131de3985d38f61",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "96e889bc1e759c83f25093e8c2f3da31b4973f30",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "0de5b8e76847f5de26f364a82c6602c4881c30da",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "427eb7eb46425fec845a43e861f3d6e2899cae59",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "86c5d470f5d42e61123b2f4b4f0b91f4eee5b980",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "46a84715a015cb48e1b9c219dc88c03d8a541ea4",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "7ad2bcf2441430bb2e918fb3ef9a90d775a6e422",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: harden POSIX SID length parsing\n\nposix_info_sid_size() reads sid[1] to obtain the subauthority count,\nbut its existing boundary check still accepts buffers with only one\nremaining byte. Require two bytes before reading sid[1] so all client\npaths that reuse the helper reject truncated POSIX SIDs safely."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious SMB server can deliver the truncated POSIX SID through SMB3.1.1 query-info or query-directory responses over TCP.\nAC:L - The server directly controls the response length and can deterministically leave exactly one SID byte remaining; no race or uncontrollable condition is required.\nPR:N - The malicious server needs no privileges on the vulnerable client, and guest-capable or attacker-controlled shares can supply the response after connection establishment.\nUI:N - On an already mounted POSIX-enabled share, routine automated stat, readdir, or metadata operations can trigger parsing without human interaction.\nS:U - The out-of-bounds access occurs within the client kernel and does not cross a virtualization, IOMMU, or other separate security authority boundary.\nC:L - The primitive reads exactly one byte beyond the response boundary, limiting any confidentiality effect to adjacent memory rather than providing an arbitrary-read primitive.\nI:N - The out-of-bounds byte only influences validation, which always rejects because a legal SID requires at least 12 bytes; no attacker-influenced copy or memory write follows.\nA:H - The server can place the truncated SID at the receive allocation boundary, where the out-of-bounds access can trigger a sanitizer fault or kernel oops and can be repeated to crash the client."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:16.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/171605aed68380c2fa75dff9b3a1ed427c50065b"
},
{
"url": "https://git.kernel.org/stable/c/4213c1208978483021d7d125c131de3985d38f61"
},
{
"url": "https://git.kernel.org/stable/c/96e889bc1e759c83f25093e8c2f3da31b4973f30"
},
{
"url": "https://git.kernel.org/stable/c/0de5b8e76847f5de26f364a82c6602c4881c30da"
},
{
"url": "https://git.kernel.org/stable/c/427eb7eb46425fec845a43e861f3d6e2899cae59"
},
{
"url": "https://git.kernel.org/stable/c/86c5d470f5d42e61123b2f4b4f0b91f4eee5b980"
},
{
"url": "https://git.kernel.org/stable/c/46a84715a015cb48e1b9c219dc88c03d8a541ea4"
},
{
"url": "https://git.kernel.org/stable/c/7ad2bcf2441430bb2e918fb3ef9a90d775a6e422"
}
],
"title": "smb: client: harden POSIX SID length parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64380",
"datePublished": "2026-07-25T08:50:30.476Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-05T12:41:16.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64381 (GCVE-0-2026-64381)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-07-25 08:50
VLAI
EPSS
VEX
Title
smb: client: Fix next buffer leak in receive_encrypted_standard()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix next buffer leak in receive_encrypted_standard()
receive_encrypted_standard() allocates next_buffer before checking
whether the number of compound PDUs already reached MAX_COMPOUND. If
the limit check fails, the function returns immediately and the newly
allocated next_buffer is not assigned to server->smallbuf/server->bigbuf,
making it leaked.
Move the MAX_COMPOUND check before allocating next_buffer.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 94e4f672db029414b9888b5137a7559f1febf2d8
(git)
Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 68fc0b6cc03ca58060c0f36454e169f5fe258974 (git) Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 07e0ab81df1790afa35732a4e8e07ff831b29008 (git) Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 9136a08dc29328edd9867f2545e73906ac9df93b (git) Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 67097772df7791c53d608f04bd31c676ccf79b83 (git) Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 297243e365fc9fe2f8e9b7dd535a65d922cd108b (git) Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 927d4805aea0a287d36dd4f826ee24d69a2afee3 (git) Affected: b24df3e30cbf48255db866720fb71f14bf9d2f39 , < 1c6267a1d5cf4c73b656f8181b310cbbb3e4767b (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94e4f672db029414b9888b5137a7559f1febf2d8",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "68fc0b6cc03ca58060c0f36454e169f5fe258974",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "07e0ab81df1790afa35732a4e8e07ff831b29008",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "9136a08dc29328edd9867f2545e73906ac9df93b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "67097772df7791c53d608f04bd31c676ccf79b83",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "297243e365fc9fe2f8e9b7dd535a65d922cd108b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "927d4805aea0a287d36dd4f826ee24d69a2afee3",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "1c6267a1d5cf4c73b656f8181b310cbbb3e4767b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix next buffer leak in receive_encrypted_standard()\n\nreceive_encrypted_standard() allocates next_buffer before checking\nwhether the number of compound PDUs already reached MAX_COMPOUND. If\nthe limit check fails, the function returns immediately and the newly\nallocated next_buffer is not assigned to server-\u003esmallbuf/server-\u003ebigbuf,\nmaking it leaked.\n\nMove the MAX_COMPOUND check before allocating next_buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:50:31.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8"
},
{
"url": "https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974"
},
{
"url": "https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008"
},
{
"url": "https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b"
},
{
"url": "https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83"
},
{
"url": "https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b"
},
{
"url": "https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3"
},
{
"url": "https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b"
}
],
"title": "smb: client: Fix next buffer leak in receive_encrypted_standard()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64381",
"datePublished": "2026-07-25T08:50:31.209Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-07-25T08:50:31.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…