{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c",
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0577c55219be42b6ea2ea8db11e85bfab6f4e8d",
              "status": "affected",
              "version": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
              "versionType": "git"
            },
            {
              "lessThan": "96ad400d5132eb333f28f6f1e2d58f0728ca9547",
              "status": "affected",
              "version": "407217734835d21d4e0105ebf347860dc1806f88",
              "versionType": "git"
            },
            {
              "lessThan": "0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0",
              "status": "affected",
              "version": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
              "versionType": "git"
            },
            {
              "lessThan": "c66a95e60b65d876a927123b0ed36bd6177d9ca6",
              "status": "affected",
              "version": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
              "versionType": "git"
            },
            {
              "lessThan": "6303ed4bbe0095f4cc195225479bf506e010d1db",
              "status": "affected",
              "version": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
              "versionType": "git"
            },
            {
              "lessThan": "26168db1ce5a9766cde021b18e590a101c056614",
              "status": "affected",
              "version": "added1213395071470a900cc845a042fb51882a6",
              "versionType": "git"
            },
            {
              "lessThan": "50c662bdcd51b03033a0abed6716bfd377ba1049",
              "status": "affected",
              "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
              "versionType": "git"
            },
            {
              "lessThan": "4bd0b274054f2679f28b70222b607bb0afc3ab9a",
              "status": "affected",
              "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.96",
              "status": "affected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.39",
              "status": "affected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c",
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.259",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.210",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.175",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.12.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable child is created through an incoming Bluetooth link, with its teardown driven by connection and disconnection events from a nearby peer. Bluetooth radio reachability is adjacent rather than routable network access.\nAC:L - The attacker can control listener cleanup and use an adjacent peer to connect and disconnect before the fixed channel becomes ready, producing the final queue-only reference state. The trigger is repeatable and Bluetooth BR/EDR support is a common default configuration.\nPR:L - Unprivileged SOCK_STREAM or SOCK_SEQPACKET L2CAP sockets and dynamic or fixed-CID binds require no capability; only raw sockets and reserved PSM binds are privileged. Although AF_BLUETOOTH requires init_net, an ordinary host user or user namespace without a new network namespace can reach it.\nUI:N - The attacker can close their own listener while controlling the peer connection lifecycle, requiring no action from another user.\nS:U - Exploitation compromises the vulnerable host kernel but does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The freed struct sock comes from the general kmalloc-2k cache and can be reclaimed with attacker-controlled data. Subsequent socket and channel dereferences can be developed into arbitrary kernel-memory disclosure.\nI:H - The UAF causes an atomic write to freed memory followed by further operations on the freed socket and channel, enabling heap-spray-based corruption and potential control-flow hijacking.\nA:H - The confirmed post-free write can cause a kernel oops or panic, and the attacker can repeat the connection, disconnection, and cleanup sequence."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:42.679Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db"
        },
        {
          "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614"
        },
        {
          "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a"
        }
      ],
      "title": "Bluetooth: fix UAF in bt_accept_dequeue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64406",
    "datePublished": "2026-07-25T08:50:47.978Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:42.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/bnep/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "390b5db3ff8745187f094c4e915663b7b1f98944",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "46a88784c4c9b96954dd86f747ce93f65efa1302",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "551ae773ec64045b4e72099132654887e0270bcc",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "ae215c5b6422d8eda443b861b124bd1be6969c31",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "df22adc7eafc22e651561813c11dc51a796b12ee",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "a6b22dbd80926556290ad2243be25218d6956a19",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "563a8573047182f550b1e1e030615755cd8c41da",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "bb067a99a0356196c0b89a95721985485ebce5a5",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/bnep/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: pin L2CAP connection during netdev registration\n\nbnep_add_connection() reads the L2CAP connection without holding the\nchannel lock, then passes its HCI device to register_netdev(). Controller\nteardown can clear and release that connection concurrently, leaving the\nnetwork device registration path to dereference a freed parent device.\n\nTake a reference to the L2CAP connection while holding the channel lock.\nRetain it until register_netdev() has taken the parent device reference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An adjacent Bluetooth peer can initiate a BNEP/PAN connection that causes privileged bluetoothd to issue BNEPCONNADD, then tear down the ACL link during netdev registration. Exploitation therefore requires Bluetooth radio adjacency.\nAC:L - The peer controls both the connection setup that triggers the ioctl and the competing disconnect, and can repeat attempts until the lifetime window is hit. No condition beyond the attacker\u0027s practical control is required.\nPR:N - The adjacent peer needs no Linux credentials or capabilities because root bluetoothd performs the CAP_NET_ADMIN ioctl on its behalf in an enabled, auto-authorized PAN deployment. The direct ioctl requires CAP_NET_ADMIN in the initial user namespace, but the adjacent path does not.\nUI:N - An enabled PAN service can automatically accept or pre-authorize connections, after which setup and teardown require no victim action. Prior service configuration is not user interaction during exploitation.\nS:U - The memory corruption occurs in the host kernel and compromises resources governed by that same kernel security authority. It does not cross a VM, IOMMU, or comparable security boundary.\nC:H - The stale parent points into a freed hci_conn allocation, and reclaiming that use-after-free object can enable disclosure of arbitrary kernel memory. Confidentiality impact is therefore High.\nI:H - device_add() calls get_device() on the freed parent, producing a refcount write into reclaimed memory and potentially further device-list corruption. The use-after-free can support arbitrary kernel-memory corruption or control-flow hijacking.\nA:H - The use-after-free can cause a kernel oops, panic, or corrupted device hierarchy during netdev registration. An adjacent peer can repeatedly initiate and terminate connections to crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:43.755Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944"
        },
        {
          "url": "https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302"
        },
        {
          "url": "https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31"
        },
        {
          "url": "https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19"
        },
        {
          "url": "https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5"
        }
      ],
      "title": "Bluetooth: bnep: pin L2CAP connection during netdev registration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64408",
    "datePublished": "2026-07-25T08:50:49.807Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:43.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btmtksdio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6682c23b6fac4780d297ae4662053d17e58fd52",
              "status": "affected",
              "version": "26270bc189ea4b5a8356ec99561357fc87f00b32",
              "versionType": "git"
            },
            {
              "lessThan": "466540e045d01fcacf383a5beb8a2dad2fc53a26",
              "status": "affected",
              "version": "26270bc189ea4b5a8356ec99561357fc87f00b32",
              "versionType": "git"
            },
            {
              "lessThan": "7b429d611060e87752e848851815537963726493",
              "status": "affected",
              "version": "26270bc189ea4b5a8356ec99561357fc87f00b32",
              "versionType": "git"
            },
            {
              "lessThan": "0039bdde36b23ccf1196635f1d52c5490481544d",
              "status": "affected",
              "version": "26270bc189ea4b5a8356ec99561357fc87f00b32",
              "versionType": "git"
            },
            {
              "lessThan": "0f0a83e26a9c7fd4b243c315ce07161d2496d83d",
              "status": "affected",
              "version": "26270bc189ea4b5a8356ec99561357fc87f00b32",
              "versionType": "git"
            },
            {
              "lessThan": "a257407e2bbbb099ed427719a50563f67fa366d8",
              "status": "affected",
              "version": "26270bc189ea4b5a8356ec99561357fc87f00b32",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btmtksdio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()\n\nEvery once in a while we see a hung btmtksdio_flush() task:\n\n INFO: task kworker/u17:0:189 blocked for more than 122 seconds.\n __cancel_work_timer+0x3f4/0x460\n cancel_work_sync+0x1c/0x2c\n btmtksdio_flush+0x2c/0x40\n hci_dev_open_sync+0x10c4/0x2190\n [..]\n\nIt all boils down to incorrect time_is_before_jiffies() usage in\nbtmtksdio_txrx_work().  The btmtksdio_txrx_work() loop is expected\nto be terminated if running for longer than 5*HZ.  However the\ntimeout check is twisted:  time_is_before_jiffies(old_jiffies + 5*HZ)\nevaluates to true when old_jiffies + 5*HZ is in the past i.e. when a\ntimeout has occurred.  Using OR with time_is_before_jiffies(txrx_timeout)\nmeans that:\n- before the 5-second timeout: the condition is `int_status || false`,\n  so it loops as long as there are pending interrupts.\n- after the 5-second timeout: the condition becomes `int_status || true`,\n  which is always true.\n\nWhen the loop becomes infinite btmtksdio_txrx_work() loop never\nterminates and never releases the SDIO host.\n\nFix loop termination condition to actually enforce a 5*HZ timeout."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:50:50.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6682c23b6fac4780d297ae4662053d17e58fd52"
        },
        {
          "url": "https://git.kernel.org/stable/c/466540e045d01fcacf383a5beb8a2dad2fc53a26"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b429d611060e87752e848851815537963726493"
        },
        {
          "url": "https://git.kernel.org/stable/c/0039bdde36b23ccf1196635f1d52c5490481544d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f0a83e26a9c7fd4b243c315ce07161d2496d83d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a257407e2bbbb099ed427719a50563f67fa366d8"
        }
      ],
      "title": "Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64409",
    "datePublished": "2026-07-25T08:50:50.604Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-07-25T08:50:50.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c046ca4e35a83ea32f6e748f54139f5fe2a1d01",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ab63ccefb9c71627f957a0724c2b9ebc869c6f20",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c6f539311e58e76aa96feef0f1572b13a564f8a2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2664f537ca5bcb2ef3fac2683dcca602e51fad24",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7436da6c1bc44654b7f11a17e746f6999fd37250",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b6183b1b88a722b6d8ea0cecc99eba168a15e0be",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n  BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n  Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n  Call Trace:\n  ...\n   string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n   vsnprintf (lib/vsprintf.c:2945)\n   __request_module (kernel/module/kmod.c:150)\n   do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n   update_counters (net/bridge/netfilter/ebtables.c:1440)\n   do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n   nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n   raw_setsockopt (net/ipv4/raw.c:847)\n   __sys_setsockopt (net/socket.c:2393)\n  ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through a local setsockopt() call into the legacy ebtables interface, not through received network traffic.\nAC:L - The attacker directly supplies a nonterminated table name and guarantees a lookup miss without racing or relying on conditions outside their control.\nPR:L - The path requires CAP_NET_ADMIN in the socket\u0027s network namespace, which an unprivileged user can obtain using a new user and network namespace.\nUI:N - No action by another user is required after the attacker invokes the crafted setsockopt() operation.\nS:U - The over-read affects the same host kernel security authority and does not cross a virtualization or comparable security boundary.\nC:H - The unbounded source read can copy kernel-stack contents into the generated module name, potentially exposing sensitive kernel data.\nI:N - The flaw performs an out-of-bounds read only; the destination formatting is bounded and no attacker-controlled write or memory corruption occurs.\nA:H - The unbounded scan can reach an unmapped stack boundary and cause an oops or panic, as supported by the demonstrated KASAN stack-out-of-bounds failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:45.899Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24"
        },
        {
          "url": "https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be"
        },
        {
          "url": "https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d"
        }
      ],
      "title": "netfilter: ebtables: terminate table name before find_table_lock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64411",
    "datePublished": "2026-07-25T08:50:52.143Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:45.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "43dd2332b8a27b3ac5108791680cade654ab0f96",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "5777c8f1c3610786d8482b8f620f40fccaf1542b",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "0ddca0f90fa3395111d078ae4399615cf3ea94aa",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "d2367d99f2455f373996d9ddbe833dbe9f942213",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "da32e78bbb187ed7b137e0007034185570a3a172",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "13a5f532e3a4fc75c33060a026def1572c208643",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            },
            {
              "lessThan": "084d23f818321390509e9738a0b08bbf46df6425",
              "status": "affected",
              "version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: module names must be null-terminated\n\nWe need to explicitly check the length, else we may pass non-null\nterminated string to request_module()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable ebtables replacement path is reached through a local setsockopt syscall, not through received network traffic.\nAC:L - The attacker controls the complete table blob, including offsets, allocation size, and unterminated match name; no race or uncontrollable condition is required.\nPR:L - The path requires CAP_NET_ADMIN in the socket network namespace, which an unprivileged user can obtain by creating user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - Exploitation requires no action by another user after the attacker invokes setsockopt with the crafted table.\nS:U - The vulnerability affects the host kernel within the same security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The unbounded %s traversal constitutes an out-of-bounds kernel read that can continue beyond the match-name field and table allocation; under the required higher-severity treatment for unbounded OOB reads, confidentiality impact is High.\nI:N - The vulnerable operation only reads while formatting a module name; there is no demonstrated out-of-bounds write, use-after-free, or control-flow modification primitive.\nA:H - A page-aligned nonzero table blob can make vsnprintf scan into the vmalloc guard page, causing a kernel oops or panic, and the attacker can repeat the trigger."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:46.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/43dd2332b8a27b3ac5108791680cade654ab0f96"
        },
        {
          "url": "https://git.kernel.org/stable/c/5777c8f1c3610786d8482b8f620f40fccaf1542b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ddca0f90fa3395111d078ae4399615cf3ea94aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2367d99f2455f373996d9ddbe833dbe9f942213"
        },
        {
          "url": "https://git.kernel.org/stable/c/da32e78bbb187ed7b137e0007034185570a3a172"
        },
        {
          "url": "https://git.kernel.org/stable/c/13a5f532e3a4fc75c33060a026def1572c208643"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/084d23f818321390509e9738a0b08bbf46df6425"
        }
      ],
      "title": "netfilter: ebtables: module names must be null-terminated",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64412",
    "datePublished": "2026-07-25T08:50:52.946Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:46.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ade612967e2cdfb9290ebcb773f302c82f311fa",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "42bef500d07b5769d916e9122a3e3fa3fd2245ef",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fc7f105451044501a50cfd530cfa3b472c54acbc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9e6c5169db423e51dcc66a73fd15409c0d38e088",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "29bf41a9b59aff9f6197df58641a00037d567ca8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f74d28e903fa4fdf82f870d0aeadddc8196e41c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5ee856e4208acafaaaf7b84824d39b78c21345d6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cbfe53599eebffd188938ab6774cc41794f6f9d5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo-\u003echainstack[1].\n\nNot a real-world bug, such allocation isn\u0027t expected to fail\nin the first place."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable translation path is reached through a local SOL_IP setsockopt(EBT_SO_SET_ENTRIES) call on an IPv4 socket, not through received network traffic.\nAC:H - Exploitation requires a boot-fixed sparse cpu_possible_mask and a per-CPU vmalloc failure after an earlier allocation succeeds. Although memory pressure is attacker-influenceable, these uncommon conditions are not fully attacker-controlled.\nPR:L - The path requires CAP_NET_ADMIN in the socket network namespace, which an unprivileged user can obtain through an owned user and network namespace where unprivileged user namespaces are enabled.\nUI:N - The attacker directly submits the crafted ebtables replacement; no victim action is required.\nS:U - This is ordinary user-namespace-to-kernel privilege escalation within the host security authority, without crossing a VM, hypervisor, or IOMMU boundary.\nC:H - The uninitialized slot can alias a live vmalloc allocation, causing it to be freed and leaving its owner with a groomable use-after-free capable of exposing arbitrary kernel memory.\nI:H - Freeing a live vmalloc-backed kernel object can enable controlled reallocation, arbitrary memory modification, and kernel control-flow hijacking.\nA:H - An invalid vfree can panic kernels configured with panic_on_warn, while freeing a live allocation creates a use-after-free that can crash or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:48.054Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088"
        },
        {
          "url": "https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5"
        }
      ],
      "title": "netfilter: ebtables: zero chainstack array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64413",
    "datePublished": "2026-07-25T08:50:53.759Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:48.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebb45c2648b1f60715fd283700f651e05e431231",
              "status": "affected",
              "version": "bbf535fd6f06b94b9d07ed6f09397a936d4a58d8",
              "versionType": "git"
            },
            {
              "lessThan": "09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9",
              "status": "affected",
              "version": "bbf535fd6f06b94b9d07ed6f09397a936d4a58d8",
              "versionType": "git"
            },
            {
              "lessThan": "36f8534f461222291a74156ab91f3ba9f09b6f93",
              "status": "affected",
              "version": "bbf535fd6f06b94b9d07ed6f09397a936d4a58d8",
              "versionType": "git"
            },
            {
              "lessThan": "006467ab932698612398f853344a7405164541f4",
              "status": "affected",
              "version": "bbf535fd6f06b94b9d07ed6f09397a936d4a58d8",
              "versionType": "git"
            },
            {
              "lessThan": "b9beed2322f3538b0d2d53307062da4102b8d8d8",
              "status": "affected",
              "version": "bbf535fd6f06b94b9d07ed6f09397a936d4a58d8",
              "versionType": "git"
            },
            {
              "lessThan": "e30453c61e185e914fde83c650e268067b140218",
              "status": "affected",
              "version": "bbf535fd6f06b94b9d07ed6f09397a936d4a58d8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix NULL pointer dereference in debugfs\n\nshrinker_debugfs_add() creates both \"count\" and \"scan\" debugfs files\nunconditionally.\n\nThat assumes every shrinker implements both count_objects() and\nscan_objects(), which is not guaranteed.  For example, the xen-backend\nshrinker sets count_objects() but leaves scan_objects() NULL, so writing\nto its scan file calls through a NULL function pointer and panics the\nkernel:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nCall Trace:\n \u003cTASK\u003e\n shrinker_debugfs_scan_write+0x12e/0x270\n full_proxy_write+0x5f/0x90\n vfs_write+0xde/0x420\n ? filp_flush+0x75/0x90\n ? filp_close+0x1d/0x30\n ? do_dup2+0xb8/0x120\n ksys_write+0x68/0xf0\n ? filp_flush+0x75/0x90\n do_syscall_64+0xb3/0x5b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe count path has the same issue in principle if a shrinker omits\ncount_objects().\n\nTo fix it, only create \"count\" and \"scan\" debugfs files when the\ncorresponding callbacks are present."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:50:56.800Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebb45c2648b1f60715fd283700f651e05e431231"
        },
        {
          "url": "https://git.kernel.org/stable/c/09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9"
        },
        {
          "url": "https://git.kernel.org/stable/c/36f8534f461222291a74156ab91f3ba9f09b6f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/006467ab932698612398f853344a7405164541f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9beed2322f3538b0d2d53307062da4102b8d8d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e30453c61e185e914fde83c650e268067b140218"
        }
      ],
      "title": "mm: shrinker: fix NULL pointer dereference in debugfs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64417",
    "datePublished": "2026-07-25T08:50:56.800Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-07-25T08:50:56.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "de5f69b8dae8698ac5e48dfcd30017887cdf4e5a",
              "status": "affected",
              "version": "5035ebc644aec92d55d1bbfe042f35341e4bffb5",
              "versionType": "git"
            },
            {
              "lessThan": "e441cbfbd0eaa6404278e985033c33caba4db767",
              "status": "affected",
              "version": "5035ebc644aec92d55d1bbfe042f35341e4bffb5",
              "versionType": "git"
            },
            {
              "lessThan": "2fed79f0fe8c8d28a972c290dbfd693c3546c8c4",
              "status": "affected",
              "version": "5035ebc644aec92d55d1bbfe042f35341e4bffb5",
              "versionType": "git"
            },
            {
              "lessThan": "560e21e8ccff813e84d05f6500907c549a3d6985",
              "status": "affected",
              "version": "5035ebc644aec92d55d1bbfe042f35341e4bffb5",
              "versionType": "git"
            },
            {
              "lessThan": "86237e56091e70f09c0fbf217f9d9c0e08f556c4",
              "status": "affected",
              "version": "5035ebc644aec92d55d1bbfe042f35341e4bffb5",
              "versionType": "git"
            },
            {
              "lessThan": "b902890c62d200b3509cb5e09cf1e0a66553c128",
              "status": "affected",
              "version": "5035ebc644aec92d55d1bbfe042f35341e4bffb5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()\n\nReading the debugfs \"count\" file of a memcg-aware shrinker can sleep\ninside an RCU read-side critical section:\n\n  BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c:421\n  RCU nest depth: 1, expected: 0\n   css_rstat_flush\n   mem_cgroup_flush_stats\n   zswap_shrinker_count\n   shrinker_debugfs_count_show\n\nshrinker_debugfs_count_show() invokes the -\u003ecount_objects() callback under\nrcu_read_lock().  The zswap callback flushes memcg stats via\ncss_rstat_flush(), which may sleep, so it must not run under RCU.\n\nThe RCU lock is not needed here.  mem_cgroup_iter() takes RCU internally\nand returns a memcg holding a css reference (dropped on the next iteration\nor by mem_cgroup_iter_break()), so the memcg stays alive without it.  The\nshrinker is kept alive by the open debugfs file: shrinker_free() removes\nthe debugfs entries via debugfs_remove_recursive(), which waits for\nin-flight readers to drain, before call_rcu(..., shrinker_free_rcu_cb). \nThe sibling \"scan\" handler already invokes the sleeping -\u003escan_objects()\ncallback with no RCU section.\n\nDrop the rcu_read_lock()/rcu_read_unlock()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:50:58.342Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/de5f69b8dae8698ac5e48dfcd30017887cdf4e5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e441cbfbd0eaa6404278e985033c33caba4db767"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fed79f0fe8c8d28a972c290dbfd693c3546c8c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/560e21e8ccff813e84d05f6500907c549a3d6985"
        },
        {
          "url": "https://git.kernel.org/stable/c/86237e56091e70f09c0fbf217f9d9c0e08f556c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b902890c62d200b3509cb5e09cf1e0a66553c128"
        }
      ],
      "title": "mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64419",
    "datePublished": "2026-07-25T08:50:58.342Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-07-25T08:50:58.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mfd/cros_ec_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24522713034d521ea4b5f5f36342e2b2f7e73bd6",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "f7e81dc181d9fe8ab977158042cd193e8cc12091",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "257203d83204b192d1265a916b42ca0d499bb117",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "729ae27dc2503a7c1f92da1859efb45da03e4fa0",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "ed2941e5db016a0c600b25f1972620e6e223d9fa",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "fc030c5b116f668d4ca86dca63742ddbc98d1665",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            },
            {
              "lessThan": "8b2c1d41bc36c100b38ce5ee6def246c527eaf8a",
              "status": "affected",
              "version": "1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mfd/cros_ec_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: cros_ec: Delay dev_set_drvdata() until probe success\n\nIf ec_device_probe() fails, cros_ec_class_release releases memory for the\ncros_ec_dev structure. However, because the drvdata was already set,\nsub-drivers like cros_ec_typec can still retrieve the stale pointer via the\nplatform device. This leads to a use-after-free when cros_ec_typec attempts\nto access \u0026typec-\u003eec-\u003eec-\u003edev on a device that has already been released.\nMove dev_set_drvdata() to ensure that the pointer is only made available\nonce all initialization steps have succeeded.\n\n sysfs: cannot create duplicate filename \u0027/class/chromeos/cros_ec\u0027\n Call trace:\n  sysfs_do_create_link_sd+0x94/0xdc\n  sysfs_create_link+0x30/0x44\n  device_add_class_symlinks+0x90/0x13c\n  device_add+0xf0/0x50c\n  ec_device_probe+0x150/0x4f0\n  platform_probe+0xa0/0xe0\n ...\n BUG: KASAN: invalid-access in __memcpy+0x44/0x230\n Write at addr f5ffff809e2d33ac by task kworker/u32:5/125\n Pointer tag: [f5], memory tag: [fe]\n Tainted : [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __memcpy+0x44/0x230\n  cros_ec_check_features+0x60/0xcc [cros_ec_proto]\n  cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]\n  platform_probe+0xa0/0xe0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF occurs in local platform-device probe work for an internally connected ChromeOS EC and its Type-C child, with no network or USB-peer entry point. Exploitation would require local heap shaping or probe-timing influence.\nAC:H - Exploitation requires EC probe failure, such as a duplicate class name, while the Type-C probe concurrently captures the pointer before driver-core cleanup, followed by useful slab reuse. An unprivileged attacker cannot directly control both sides of this race.\nPR:L - On a device whose firmware topology already produces the failure, no capability check protects the automatic probe path, and an unprivileged local process can attempt heap grooming and timing manipulation. User namespaces cannot directly create or rebind these platform devices, but real-root privileges are not required for that exploitation role.\nUI:N - The kernel automatically enumerates and probes both devices through platform-bus workqueues. No victim action such as opening a file, mounting something, or attaching a peripheral is required.\nS:U - The vulnerable driver and the affected kernel memory share the same operating-system security authority. This is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - The freed object contains kernel pointers and may be replaced by another kmalloc object before stale accesses occur. Exploitable UAF reuse can provide kernel-memory disclosure, so confidentiality impact is High.\nI:H - cros_ec_check_features() can copy an eight-byte EC feature response into the freed object, corrupting any replacement object occupying that slab slot. Heap shaping could turn this write-after-free into control-flow corruption or kernel code execution.\nA:H - The observed write-after-free occurs in a kernel workqueue and can produce an oops or panic. It can also disrupt device initialization or repeatedly prevent a vulnerable system from completing a reliable boot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:51.271Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091"
        },
        {
          "url": "https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117"
        },
        {
          "url": "https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a"
        }
      ],
      "title": "mfd: cros_ec: Delay dev_set_drvdata() until probe success",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64420",
    "datePublished": "2026-07-25T08:50:59.115Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-05T12:41:51.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/sysctl_net_ipv4.c",
            "net/ipv4/tcp_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f0d88a4cd03affff6c08adf6c63964e235aede43",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "27ddf4486c7dbf5bdd393fa8bef6b67179796d98",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "e81f805824a8109504fce090641b17d135b48cd1",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "99206ce2244f8a3ed64298d0667c9055845a5dc7",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "bbae351c0f32f7c200249e4aa6561b2b419dcf69",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "a094ac95d3b69adfa1676eb9c8eae6835d4f1671",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            },
            {
              "lessThan": "efb8763d7bbb40cff4cc55a6b62c3095a038149c",
              "status": "affected",
              "version": "91cc17c0e5e5ada156a8d5787a2509d263ea6bbf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/sysctl_net_ipv4.c",
            "net/ipv4/tcp_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: bound TCP reordering sysctl writes and MTU probe sizes\n\nReject invalid `net.ipv4.tcp_reordering` values before they reach TCP\nsocket state. The sysctl is stored as an `int` but copied into the\n`u32` `tp-\u003ereordering` field for new sockets, so negative writes wrap\nto large values.\n\nWith `tcp_mtu_probing=2`, the wrapped value can overflow the\n`tcp_mtu_probe()` size calculation and drive the MTU probing path into\nan out-of-bounds read. Route `tcp_reordering` writes through\n`proc_dointvec_minmax()` and require it to be at least 1. Also require\n`tcp_max_reordering` to be at least 1 so the configured maximum cannot\nbecome negative either.\n\nWhen registering the table for a non-init network namespace, relocate\n`extra2` pointers that refer into `init_net.ipv4` so the\n`tcp_reordering` upper bound follows that namespace\u0027s\n`tcp_max_reordering`.\n\nHarden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`.\nThis keeps the send queue and window checks from being bypassed through\nsigned integer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must locally write the per-network-namespace TCP sysctls and exercise a TCP socket; remote packets alone cannot introduce the invalid signed value.\nAC:L - The attacker can set both tcp_reordering and tcp_mtu_probing=2, establish an attacker-controlled TCP connection, grow its congestion window, and control queued data and receiver-window conditions.\nPR:L - Writes require CAP_NET_ADMIN in the network namespace\u2019s owning user namespace, which an unprivileged user can obtain by creating user and network namespaces on systems permitting unprivileged user namespaces.\nUI:N - The attacker can configure the namespace and trigger MTU probing using their own TCP endpoints without any victim action.\nS:U - The vulnerable TCP implementation and the affected kernel memory and availability remain within the Linux kernel\u2019s security authority.\nC:H - The overflow bypasses send-queue validation and causes an out-of-bounds kernel-memory read through an invalid skb traversal, potentially exposing sensitive kernel data.\nI:N - The established primitive is an out-of-bounds read and malformed skb state; the affected path provides no demonstrated out-of-bounds write or other data-modification primitive.\nA:H - The invalid skb access and inconsistent payload geometry can cause an OOPS, BUG, or kernel panic, and an attacker can trigger the path repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:52.362Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43"
        },
        {
          "url": "https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98"
        },
        {
          "url": "https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae"
        },
        {
          "url": "https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69"
        },
        {
          "url": "https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671"
        },
        {
          "url": "https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c"
        }
      ],
      "title": "net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64422",
    "datePublished": "2026-07-25T08:51:00.671Z",
    "dateReserved": "2026-07-19T15:36:31.787Z",
    "dateUpdated": "2026-08-05T12:41:52.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}