Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0982
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.262-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
},
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.180-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64376"
},
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-64275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64275"
},
{
"name": "CVE-2026-64274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64274"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64452"
},
{
"name": "CVE-2026-64483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64483"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-64409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64409"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-64489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64489"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64480"
},
{
"name": "CVE-2026-64399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64399"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-64454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64454"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2026-53400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
},
{
"name": "CVE-2026-64365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64365"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64514"
},
{
"name": "CVE-2026-64279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64279"
},
{
"name": "CVE-2026-64337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64337"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64430"
},
{
"name": "CVE-2026-64497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64497"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-64276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
},
{
"name": "CVE-2026-64475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64475"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64271"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64455"
},
{
"name": "CVE-2026-52942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52942"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-64445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64445"
},
{
"name": "CVE-2026-64500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64500"
},
{
"name": "CVE-2026-63806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
},
{
"name": "CVE-2026-64330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64330"
},
{
"name": "CVE-2026-64348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64348"
},
{
"name": "CVE-2026-64469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64469"
},
{
"name": "CVE-2026-64362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64362"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-64486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64486"
},
{
"name": "CVE-2026-64446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64446"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64338"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-64536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64536"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-64351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64351"
},
{
"name": "CVE-2026-23204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-64432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64432"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-53332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53332"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64296"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64370"
},
{
"name": "CVE-2026-43216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43216"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-64299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64299"
},
{
"name": "CVE-2026-64374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64374"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64345"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-64504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64504"
},
{
"name": "CVE-2026-64398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64398"
},
{
"name": "CVE-2026-64297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64297"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-64397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64397"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-64468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64468"
},
{
"name": "CVE-2026-64449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64449"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-63797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
},
{
"name": "CVE-2026-64456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64456"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64465"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-64442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64442"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64248"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64458"
},
{
"name": "CVE-2026-64476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64476"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-64318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64318"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-64394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64394"
},
{
"name": "CVE-2026-53177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-64435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64435"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64336"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64346"
},
{
"name": "CVE-2026-31610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31610"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-64342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64342"
},
{
"name": "CVE-2026-64360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64360"
},
{
"name": "CVE-2022-50114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50114"
},
{
"name": "CVE-2026-64478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64478"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64437"
},
{
"name": "CVE-2026-64335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64335"
},
{
"name": "CVE-2026-64301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64301"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-64395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64395"
},
{
"name": "CVE-2026-64273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64273"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2024-36013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36013"
},
{
"name": "CVE-2025-40196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40196"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-46135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46135"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-53393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
},
{
"name": "CVE-2026-64496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64496"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-64316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64316"
},
{
"name": "CVE-2026-64417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64417"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-64443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64443"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-64269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64269"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64482"
},
{
"name": "CVE-2026-64495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64495"
},
{
"name": "CVE-2026-64396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64396"
},
{
"name": "CVE-2026-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64324"
},
{
"name": "CVE-2026-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64329"
},
{
"name": "CVE-2026-64373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64373"
},
{
"name": "CVE-2026-64277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
},
{
"name": "CVE-2026-64503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64503"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-64403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64403"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-64487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64487"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-64429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64429"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-64350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64350"
},
{
"name": "CVE-2026-64250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64250"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-64448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64448"
},
{
"name": "CVE-2026-64347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64347"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2026-64393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64393"
},
{
"name": "CVE-2026-64419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64419"
},
{
"name": "CVE-2026-64372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64372"
},
{
"name": "CVE-2026-64444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64444"
},
{
"name": "CVE-2022-49803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49803"
},
{
"name": "CVE-2026-64331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64331"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64494"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64379"
},
{
"name": "CVE-2026-64420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64420"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
},
{
"name": "CVE-2026-64425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64425"
},
{
"name": "CVE-2026-64600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64600"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64505"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-64422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64422"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64484"
},
{
"name": "CVE-2026-64298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2023-52494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52494"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
},
{
"name": "CVE-2026-63829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
},
{
"name": "CVE-2026-64440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64440"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
},
{
"name": "CVE-2026-64359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64359"
},
{
"name": "CVE-2026-43219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43219"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0982",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00007",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00007.html"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00008",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00008.html"
}
]
}
CVE-2026-64452 (GCVE-0-2026-64452)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
6lowpan: fix NHC entry use-after-free on error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix NHC entry use-after-free on error path
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding
lowpan_nhc_lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies
on synchronize_net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan_header_decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan_nhc_lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize_net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220
Read of size 8
lowpan_nhc_do_uncompression
lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
92aa7c65d295f3cbb96904afe335f683e55584b8 , < 9c2f5c0829a8c8b904dae36be6d8056b719ac605
(git)
Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < 80b5c8779acee0550845394fb3e5176a398aa24c (git) Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < cc27aea4d454abfb385ee2c9499c78b96db9b728 (git) Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < a8e3a94711134e898c6021a6b77374efa91b3639 (git) Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < 593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168 (git) Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < 0beccbcf50de125be5520d0ffc59af4bb8655482 (git) Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < b713aa0cc344f10f7a9928a230b5f5e780d04078 (git) Affected: 92aa7c65d295f3cbb96904afe335f683e55584b8 , < 1720db928e5a58ca7d75ac1d514c3b73fd7061a7 (git) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/6lowpan/nhc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c2f5c0829a8c8b904dae36be6d8056b719ac605",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "80b5c8779acee0550845394fb3e5176a398aa24c",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "cc27aea4d454abfb385ee2c9499c78b96db9b728",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "a8e3a94711134e898c6021a6b77374efa91b3639",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "0beccbcf50de125be5520d0ffc59af4bb8655482",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "b713aa0cc344f10f7a9928a230b5f5e780d04078",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
},
{
"lessThan": "1720db928e5a58ca7d75ac1d514c3b73fd7061a7",
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/6lowpan/nhc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix NHC entry use-after-free on error path\n\nlowpan_nhc_do_uncompression() looks up an NHC descriptor while holding\nlowpan_nhc_lock. If the descriptor has no uncompress callback, the error\npath drops the lock before printing nhc-\u003ename.\n\nlowpan_nhc_del() removes descriptors under the same lock and then relies\non synchronize_net() before the owning module can be unloaded. That only\nwaits for net RX RCU readers. lowpan_header_decompress() is also exported\nand can be reached from callers that are not necessarily covered by the net\ncore RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive\npath.\n\nThis leaves a race where one task drops lowpan_nhc_lock in the error path,\nanother task unregisters and frees the matching descriptor after\nsynchronize_net() returns, and the first task then dereferences nhc-\u003ename\nfor the warning.\n\nWith the post-unlock window widened, KASAN reports:\n\n BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220\n Read of size 8\n lowpan_nhc_do_uncompression\n lowpan_header_decompress\n\nFix this by printing the warning before dropping lowpan_nhc_lock, so the\ndescriptor name is read while unregister is still excluded. The malformed\npacket is still rejected with -ENOTSUPP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An adjacent Bluetooth LE peer can deliver a crafted IPHC/NHC frame through the unauthenticated L2CAP IPSP receive path to the vulnerable decompressor.\nAC:H - Exploitation requires the matching loadable NHC descriptor to be unregistered and freed during the tiny post-unlock window, and the adjacent attacker cannot independently force that module-unload side of the race.\nPR:N - The Bluetooth packet-processing path requires no attacker privileges or authenticated pairing because the IPSP channel uses BT_SECURITY_LOW; CAP_SYS_MODULE belongs to the victim-side unload actor.\nUI:R - Successful triggering requires a victim administrator or module-management action to unload the matching NHC module while the malicious packet is being processed.\nS:U - The vulnerability compromises the affected host kernel without crossing a separate virtualization, IOMMU, or security-authority boundary.\nC:H - The freed descriptor\u0027s name pointer is dereferenced as a string, so reused contents can cause an unbounded kernel-memory read and disclosure through the kernel log.\nI:H - As a kernel-space use-after-free, freed-object replacement is conservatively treated as potentially enabling memory-corruption or control-flow compromise.\nA:H - Dereferencing an invalid freed descriptor or string pointer can produce a kernel oops or panic and render the system unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:15.095Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605"
},
{
"url": "https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c"
},
{
"url": "https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728"
},
{
"url": "https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639"
},
{
"url": "https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168"
},
{
"url": "https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482"
},
{
"url": "https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078"
},
{
"url": "https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7"
}
],
"title": "6lowpan: fix NHC entry use-after-free on error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64452",
"datePublished": "2026-07-25T08:51:21.754Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-08-05T12:42:15.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64454 (GCVE-0-2026-64454)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
usb: dwc3: run gadget disconnect from sleepable suspend context
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: run gadget disconnect from sleepable suspend context
dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls
dwc3_disconnect_gadget(). For async callbacks that helper only uses
plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback
still runs with IRQs disabled and any sleepable callback trips Lockdep.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the dwc3_gadget_suspend() ->
dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and
Lockdep reported:
BUG: sleeping function called from invalid context
gadget_disconnect+0x21/0x39 [vuln_msv]
dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]
Keep the disconnect callback selection in one common helper, but add a
sleepable suspend-side wrapper which snapshots the callback under
dwc->lock and then runs it after spin_unlock_irqrestore(). The regular
event path still uses the existing spin_unlock()/spin_lock() window.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
20351ddb1f41cfb3ae20e105425ef43a28393d76 , < b399be2958456efe1b64b19c55a54a24e9035769
(git)
Affected: ad43004fd5326bec4466ecc8a07fe0e570b553ca , < 48958478cb8dbc429a5b19f36e866b63d6297d1d (git) Affected: c8540870af4ce6ddeb27a7bb5498b75fb29b643c , < 5e5798880eb1533a7de6fb68eb14b2d8202ebf76 (git) Affected: c8540870af4ce6ddeb27a7bb5498b75fb29b643c , < e0e4f15d4225fb7156cc0e3c21eb8953114f9b89 (git) Affected: c8540870af4ce6ddeb27a7bb5498b75fb29b643c , < c4e232bd07fe2b69a6e5c380db41dd36b95e0524 (git) Affected: c8540870af4ce6ddeb27a7bb5498b75fb29b643c , < 642e04f5c292d04070ae6e4374fbf14cc40a2465 (git) Affected: c8540870af4ce6ddeb27a7bb5498b75fb29b643c , < 010382937fb69892b3469ac4d30af072262f59e8 (git) Affected: 06684c72b6b153dc434bb6ccebbb49f4cd812b5e (git) Affected: 5.15.128 , < 5.15.212 (semver) Affected: 6.1.30 , < 6.1.178 (semver) Affected: 6.3.4 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b399be2958456efe1b64b19c55a54a24e9035769",
"status": "affected",
"version": "20351ddb1f41cfb3ae20e105425ef43a28393d76",
"versionType": "git"
},
{
"lessThan": "48958478cb8dbc429a5b19f36e866b63d6297d1d",
"status": "affected",
"version": "ad43004fd5326bec4466ecc8a07fe0e570b553ca",
"versionType": "git"
},
{
"lessThan": "5e5798880eb1533a7de6fb68eb14b2d8202ebf76",
"status": "affected",
"version": "c8540870af4ce6ddeb27a7bb5498b75fb29b643c",
"versionType": "git"
},
{
"lessThan": "e0e4f15d4225fb7156cc0e3c21eb8953114f9b89",
"status": "affected",
"version": "c8540870af4ce6ddeb27a7bb5498b75fb29b643c",
"versionType": "git"
},
{
"lessThan": "c4e232bd07fe2b69a6e5c380db41dd36b95e0524",
"status": "affected",
"version": "c8540870af4ce6ddeb27a7bb5498b75fb29b643c",
"versionType": "git"
},
{
"lessThan": "642e04f5c292d04070ae6e4374fbf14cc40a2465",
"status": "affected",
"version": "c8540870af4ce6ddeb27a7bb5498b75fb29b643c",
"versionType": "git"
},
{
"lessThan": "010382937fb69892b3469ac4d30af072262f59e8",
"status": "affected",
"version": "c8540870af4ce6ddeb27a7bb5498b75fb29b643c",
"versionType": "git"
},
{
"status": "affected",
"version": "06684c72b6b153dc434bb6ccebbb49f4cd812b5e",
"versionType": "git"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.128",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: run gadget disconnect from sleepable suspend context\n\ndwc3_gadget_suspend() takes dwc-\u003elock with IRQs disabled and then calls\ndwc3_disconnect_gadget(). For async callbacks that helper only uses\nplain spin_unlock()/spin_lock(), so the gadget -\u003edisconnect() callback\nstill runs with IRQs disabled and any sleepable callback trips Lockdep.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the dwc3_gadget_suspend() -\u003e\ndwc3_disconnect_gadget() -\u003e gadget_driver-\u003edisconnect() chain, and\nLockdep reported:\n\n BUG: sleeping function called from invalid context\n gadget_disconnect+0x21/0x39 [vuln_msv]\n dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]\n\nKeep the disconnect callback selection in one common helper, but add a\nsleepable suspend-side wrapper which snapshots the callback under\ndwc-\u003elock and then runs it after spin_unlock_irqrestore(). The regular\nevent path still uses the existing spin_unlock()/spin_lock() window."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:23.212Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769"
},
{
"url": "https://git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d"
},
{
"url": "https://git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76"
},
{
"url": "https://git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89"
},
{
"url": "https://git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524"
},
{
"url": "https://git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465"
},
{
"url": "https://git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8"
}
],
"title": "usb: dwc3: run gadget disconnect from sleepable suspend context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64454",
"datePublished": "2026-07-25T08:51:23.212Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-07-25T08:51:23.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64455 (GCVE-0-2026-64455)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
The chaoskey driver has a use-after-free bug in its release routine.
If the user closes the device file after the USB device has been
unplugged, a debugging log statement will try to access the
usb_interface structure after it has been deallocated:
BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)
Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
dev_driver_string (drivers/base/core.c:2406)
__dynamic_dev_dbg (lib/dynamic_debug.c:906)
chaoskey_release (drivers/usb/misc/chaoskey.c:323)
__fput (fs/file_table.c:510)
fput_close_sync (fs/file_table.c:615)
__x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The driver's last reference to the interface structure is dropped in
the chaoskey_free() routine, so the code must not use the interface --
even in a debugging statement -- after that routine returns.
(Exception: If we know that another reference is held by someone else,
such as the device core while the disconnect routine runs, there's no
problem. Thanks to Johan Hovold for pointing this out.)
Since the bad access is part of an unimportant debugging statement,
we can fix the problem simply by removing the whole statement.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
66e3e591891da9899a8990792da080432531ffd4 , < fe7a0f4be283b40dd592540027279735120d0d6f
(git)
Affected: 66e3e591891da9899a8990792da080432531ffd4 , < 5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023 (git) Affected: 66e3e591891da9899a8990792da080432531ffd4 , < f3e409476ad0703c54c14f245e4e143c8124e1bd (git) Affected: 66e3e591891da9899a8990792da080432531ffd4 , < 6c82f88bc7a8458d5c60f9b354c4d32d233f0cac (git) Affected: 66e3e591891da9899a8990792da080432531ffd4 , < 3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89 (git) Affected: 66e3e591891da9899a8990792da080432531ffd4 , < 2a52d55c86a429dac47886b8424e67f90b001e67 (git) Affected: 66e3e591891da9899a8990792da080432531ffd4 , < 8f50613bff228272577893aa10a346a2f3063e49 (git) Affected: 66e3e591891da9899a8990792da080432531ffd4 , < abf76d3239dee97b66e7241ad04811f1ce562e28 (git) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/chaoskey.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe7a0f4be283b40dd592540027279735120d0d6f",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "f3e409476ad0703c54c14f245e4e143c8124e1bd",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "6c82f88bc7a8458d5c60f9b354c4d32d233f0cac",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "2a52d55c86a429dac47886b8424e67f90b001e67",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "8f50613bff228272577893aa10a346a2f3063e49",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
},
{
"lessThan": "abf76d3239dee97b66e7241ad04811f1ce562e28",
"status": "affected",
"version": "66e3e591891da9899a8990792da080432531ffd4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/chaoskey.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: chaoskey: Fix slab-use-after-free in chaoskey_release()\n\nThe chaoskey driver has a use-after-free bug in its release routine.\nIf the user closes the device file after the USB device has been\nunplugged, a debugging log statement will try to access the\nusb_interface structure after it has been deallocated:\n\n\tBUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)\n\tRead of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106\n\n\tHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t \u003cTASK\u003e\n\t dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n\t print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n\t kasan_report (mm/kasan/report.c:595)\n\t dev_driver_string (drivers/base/core.c:2406)\n\t __dynamic_dev_dbg (lib/dynamic_debug.c:906)\n\t chaoskey_release (drivers/usb/misc/chaoskey.c:323)\n\t __fput (fs/file_table.c:510)\n\t fput_close_sync (fs/file_table.c:615)\n\t __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)\n\t do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n\t entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nThe driver\u0027s last reference to the interface structure is dropped in\nthe chaoskey_free() routine, so the code must not use the interface --\neven in a debugging statement -- after that routine returns.\n(Exception: If we know that another reference is held by someone else,\nsuch as the device core while the disconnect routine runs, there\u0027s no\nproblem. Thanks to Johan Hovold for pointing this out.)\n\nSince the bad access is part of an unimportant debugging statement,\nwe can fix the problem simply by removing the whole statement."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:23.952Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe7a0f4be283b40dd592540027279735120d0d6f"
},
{
"url": "https://git.kernel.org/stable/c/5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023"
},
{
"url": "https://git.kernel.org/stable/c/f3e409476ad0703c54c14f245e4e143c8124e1bd"
},
{
"url": "https://git.kernel.org/stable/c/6c82f88bc7a8458d5c60f9b354c4d32d233f0cac"
},
{
"url": "https://git.kernel.org/stable/c/3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89"
},
{
"url": "https://git.kernel.org/stable/c/2a52d55c86a429dac47886b8424e67f90b001e67"
},
{
"url": "https://git.kernel.org/stable/c/8f50613bff228272577893aa10a346a2f3063e49"
},
{
"url": "https://git.kernel.org/stable/c/abf76d3239dee97b66e7241ad04811f1ce562e28"
}
],
"title": "USB: chaoskey: Fix slab-use-after-free in chaoskey_release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64455",
"datePublished": "2026-07-25T08:51:23.952Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-07-25T08:51:23.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64456 (GCVE-0-2026-64456)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
hwrng: virtio: clamp device-reported used.len at copy_data()
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwrng: virtio: clamp device-reported used.len at copy_data()
random_recv_done() stores the device-reported used.len directly into
vi->data_avail. copy_data() then indexes vi->data[] using
vi->data_idx (advanced by previous copy_data() calls) and issues a
memcpy() without re-validating either value against the posted
buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32
or 64).
A malicious or buggy virtio-rng backend can set used.len beyond
sizeof(vi->data), steering the memcpy() past the end of the inline
array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes
those bytes into the guest RNG, and guest root can also observe
them directly via /dev/hwrng.
Concrete impact is inside the guest:
- Memory-safety / hardening: any virtio-rng backend that
over-reports used.len causes the driver to read past vi->data
into unrelated slab contents. hwrng_fillfn() is a kernel thread
that runs as soon as the device is probed; no guest userspace
interaction is required to first-trigger the OOB.
- Cross-boundary leak (confidential-compute threat model): a
malicious hypervisor cooperating with a malicious or compromised
guest root userspace can use /dev/hwrng as a leak channel for
guest-kernel heap data. The host sets a large used.len, guest
root reads /dev/hwrng, and the returned bytes contain guest
kernel slab contents that were adjacent to vi->data. In
practice, confidential-compute guests (SEV-SNP, TDX) usually
disable virtio-rng entirely, so this path is narrow, but the
fix is still worth carrying because the underlying
memory-safety bug contaminates the guest RNG on any host.
KASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend
has been patched to report used.len = 0x10000:
BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0
Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52
Call Trace:
__asan_memcpy+0x23/0x60
virtio_read+0x394/0x5d0
hwrng_fillfn+0xb2/0x470
kthread+0x2cc/0x3a0
Allocated by task 1:
probe_common+0xa5/0x660
virtio_dev_probe+0x549/0xbc0
The buggy address belongs to the object at ffff88800ae0b800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes to the right of
allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)
Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer
overflow in USB transport layer"), which hardened
usb9pfs_rx_complete() against unchecked device-reported length in
the USB 9p transport.
With the clamp at point of use and array_index_nospec() in place,
the same harness boots cleanly: copy_data() returns zero for the
bogus report, the device-supplied bytes after data_idx are
discarded, and the driver issues a fresh request.
Severity
7.7 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f7f510ec195781c857ab76366a3e1c59e1caae42 , < 3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5
(git)
Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < 63335e7b638ae70028ae285bb95153874a8bc852 (git) Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < 2e788948ff2a13358a303af112497a63201c5739 (git) Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < fde19b0d4eeabae042519313c843fe6f27d41e9d (git) Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < 81dd21b5f0c299cc7b5bf84f04a61938559d20e6 (git) Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < 285e17c44e3873a73460f294acbd64018ff64385 (git) Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < 92d5736a62040ec1cfff23ea57e6599301690ad5 (git) Affected: f7f510ec195781c857ab76366a3e1c59e1caae42 , < e3046eeada299f917a8ad883af4434bfb86556b1 (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/hw_random/virtio-rng.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "63335e7b638ae70028ae285bb95153874a8bc852",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "2e788948ff2a13358a303af112497a63201c5739",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "fde19b0d4eeabae042519313c843fe6f27d41e9d",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "81dd21b5f0c299cc7b5bf84f04a61938559d20e6",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "285e17c44e3873a73460f294acbd64018ff64385",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "92d5736a62040ec1cfff23ea57e6599301690ad5",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
},
{
"lessThan": "e3046eeada299f917a8ad883af4434bfb86556b1",
"status": "affected",
"version": "f7f510ec195781c857ab76366a3e1c59e1caae42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/hw_random/virtio-rng.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: virtio: clamp device-reported used.len at copy_data()\n\nrandom_recv_done() stores the device-reported used.len directly into\nvi-\u003edata_avail. copy_data() then indexes vi-\u003edata[] using\nvi-\u003edata_idx (advanced by previous copy_data() calls) and issues a\nmemcpy() without re-validating either value against the posted\nbuffer size sizeof(vi-\u003edata) (SMP_CACHE_BYTES bytes, typically 32\nor 64).\n\nA malicious or buggy virtio-rng backend can set used.len beyond\nsizeof(vi-\u003edata), steering the memcpy() past the end of the inline\narray into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes\nthose bytes into the guest RNG, and guest root can also observe\nthem directly via /dev/hwrng.\n\nConcrete impact is inside the guest:\n\n - Memory-safety / hardening: any virtio-rng backend that\n over-reports used.len causes the driver to read past vi-\u003edata\n into unrelated slab contents. hwrng_fillfn() is a kernel thread\n that runs as soon as the device is probed; no guest userspace\n interaction is required to first-trigger the OOB.\n\n - Cross-boundary leak (confidential-compute threat model): a\n malicious hypervisor cooperating with a malicious or compromised\n guest root userspace can use /dev/hwrng as a leak channel for\n guest-kernel heap data. The host sets a large used.len, guest\n root reads /dev/hwrng, and the returned bytes contain guest\n kernel slab contents that were adjacent to vi-\u003edata. In\n practice, confidential-compute guests (SEV-SNP, TDX) usually\n disable virtio-rng entirely, so this path is narrow, but the\n fix is still worth carrying because the underlying\n memory-safety bug contaminates the guest RNG on any host.\n\nKASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend\nhas been patched to report used.len = 0x10000:\n\n BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0\n Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52\n Call Trace:\n __asan_memcpy+0x23/0x60\n virtio_read+0x394/0x5d0\n hwrng_fillfn+0xb2/0x470\n kthread+0x2cc/0x3a0\n Allocated by task 1:\n probe_common+0xa5/0x660\n virtio_dev_probe+0x549/0xbc0\n The buggy address belongs to the object at ffff88800ae0b800\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 0 bytes to the right of\n allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened\nusb9pfs_rx_complete() against unchecked device-reported length in\nthe USB 9p transport.\n\nWith the clamp at point of use and array_index_nospec() in place,\nthe same harness boots cleanly: copy_data() returns zero for the\nbogus report, the device-supplied bytes after data_idx are\ndiscarded, and the driver issues a fresh request."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker must control a virtio-rng backend or hypervisor locally attached to the guest; no network or physical packet path reaches this driver.\nAC:L - The backend directly controls the 32-bit used.len and can deterministically over-report it without winning a race or manipulating an uncertain memory layout.\nPR:N - No privileges inside the vulnerable guest are required because the hwrng kernel thread automatically consumes backend completions after device registration.\nUI:N - The automatically started hwrng thread triggers the out-of-bounds read without any victim action or guest userspace request.\nS:U - The vulnerable driver and the affected memory, RNG state, and availability all belong to the same guest-kernel security authority; this is not a guest-to-host escape.\nC:H - Repeated bounded copies advance through a device-selected, potentially enormous length, producing sequential out-of-bounds reads of guest-kernel heap memory that guest root can observe through /dev/hwrng.\nI:N - The memcpy destination remains bounded by the hwrng core buffer, so the flaw provides no out-of-bounds write, use-after-free, or control-flow modification primitive.\nA:H - A sufficiently large reported length drives reads beyond valid slab memory, causing a kernel out-of-bounds fault, oops, or panic, and the malicious backend can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:16.173Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5"
},
{
"url": "https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852"
},
{
"url": "https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739"
},
{
"url": "https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d"
},
{
"url": "https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6"
},
{
"url": "https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385"
},
{
"url": "https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5"
},
{
"url": "https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1"
}
],
"title": "hwrng: virtio: clamp device-reported used.len at copy_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64456",
"datePublished": "2026-07-25T08:51:24.659Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-08-05T12:42:16.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64458 (GCVE-0-2026-64458)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
mm/damon/ops-common: handle extreme intervals in damon_hot_score()
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/ops-common: handle extreme intervals in damon_hot_score()
Fix three issues in damon_hot_score() that comes from wrong handling of
extreme (zero or too high) monitoring intervals user setup.
When the user sets sampling interval zero, damon_max_nr_accesses(), which
is called from damon_hot_score(), causes a divide-by-zero. Needless to
say, it is a problem.
When the user sets the aggregation interval zero, the function returns
zero. It is wrong, since the real maximum nr_acceses in the setup should
be one. Worse yet, it can cause another divide-by-zero from its caller,
damon_hot_score(), since it uses damon_max_nr_accesses() return value as a
denominator.
When the user sets the aggregation interval very high, damon_hot_score()
could return a value out of [0, DAMOS_MAX_SCORE] range. Since the return
value is used as an index to the regions_score_histogram array, which is
DAMOS_MAX_SCORE+1 size, it causes out of bounds array access.
The issues can be relatively easily reproduced like below. The sysfs
write permission is required, though.
# ./damo start --damos_action lru_prio --damos_quota_space 100M \
--damos_quota_interval 1s
# cd /sys/kernel/mm/damon/admin/kdamonds/0
# echo 0 > contexts/0/monitoring_attrs/intervals/sample_us
# echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us
# echo commit > state
# dmesg
[...]
[ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI
[...]
[ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0
[...]
Fix the divide-by-zero intervals problems by explicitly handling the zero
intervals in damon_max_nr_accesses(). Fix the out-of-bound array access
by applying [0, DAMOS_MAX_SCORE] bounds before returning from
damon_hot_score().
The issue was discovered [1] by Sashiko.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f , < 58321b4e6e4f0f412069ab27ccdd56292757343a
(git)
Affected: 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f , < 74fef68d521150281e36cdaa20e9e1ee3e3aa146 (git) Affected: 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f , < ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a (git) Affected: 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f , < 9c8f31eaae6140ecadec0c07320498a944556de2 (git) Affected: 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f , < 76e415ea88d20f022ed5cfcf78c50e156a267e91 (git) Affected: 198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f , < 35d4a3cf70a855b50e53189ac2f8463e20a02046 (git) |
|
| Linux | Linux |
Affected:
5.16
Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/damon.h",
"mm/damon/ops-common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58321b4e6e4f0f412069ab27ccdd56292757343a",
"status": "affected",
"version": "198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f",
"versionType": "git"
},
{
"lessThan": "74fef68d521150281e36cdaa20e9e1ee3e3aa146",
"status": "affected",
"version": "198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f",
"versionType": "git"
},
{
"lessThan": "ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a",
"status": "affected",
"version": "198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f",
"versionType": "git"
},
{
"lessThan": "9c8f31eaae6140ecadec0c07320498a944556de2",
"status": "affected",
"version": "198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f",
"versionType": "git"
},
{
"lessThan": "76e415ea88d20f022ed5cfcf78c50e156a267e91",
"status": "affected",
"version": "198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f",
"versionType": "git"
},
{
"lessThan": "35d4a3cf70a855b50e53189ac2f8463e20a02046",
"status": "affected",
"version": "198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/damon.h",
"mm/damon/ops-common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/ops-common: handle extreme intervals in damon_hot_score()\n\nFix three issues in damon_hot_score() that comes from wrong handling of\nextreme (zero or too high) monitoring intervals user setup.\n\nWhen the user sets sampling interval zero, damon_max_nr_accesses(), which\nis called from damon_hot_score(), causes a divide-by-zero. Needless to\nsay, it is a problem.\n\nWhen the user sets the aggregation interval zero, the function returns\nzero. It is wrong, since the real maximum nr_acceses in the setup should\nbe one. Worse yet, it can cause another divide-by-zero from its caller,\ndamon_hot_score(), since it uses damon_max_nr_accesses() return value as a\ndenominator.\n\nWhen the user sets the aggregation interval very high, damon_hot_score()\ncould return a value out of [0, DAMOS_MAX_SCORE] range. Since the return\nvalue is used as an index to the regions_score_histogram array, which is\nDAMOS_MAX_SCORE+1 size, it causes out of bounds array access.\n\nThe issues can be relatively easily reproduced like below. The sysfs\nwrite permission is required, though.\n\n # ./damo start --damos_action lru_prio --damos_quota_space 100M \\\n --damos_quota_interval 1s\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 \u003e contexts/0/monitoring_attrs/intervals/sample_us\n # echo 0 \u003e contexts/0/monitoring_attrs/intervals/aggr_us\n # echo commit \u003e state\n # dmesg\n [...]\n [ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI\n [...]\n [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0\n [...]\n\nFix the divide-by-zero intervals problems by explicitly handling the zero\nintervals in damon_max_nr_accesses(). Fix the out-of-bound array access\nby applying [0, DAMOS_MAX_SCORE] bounds before returning from\ndamon_hot_score().\n\nThe issue was discovered [1] by Sashiko."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:26.072Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58321b4e6e4f0f412069ab27ccdd56292757343a"
},
{
"url": "https://git.kernel.org/stable/c/74fef68d521150281e36cdaa20e9e1ee3e3aa146"
},
{
"url": "https://git.kernel.org/stable/c/ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a"
},
{
"url": "https://git.kernel.org/stable/c/9c8f31eaae6140ecadec0c07320498a944556de2"
},
{
"url": "https://git.kernel.org/stable/c/76e415ea88d20f022ed5cfcf78c50e156a267e91"
},
{
"url": "https://git.kernel.org/stable/c/35d4a3cf70a855b50e53189ac2f8463e20a02046"
}
],
"title": "mm/damon/ops-common: handle extreme intervals in damon_hot_score()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64458",
"datePublished": "2026-07-25T08:51:26.072Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-07-25T08:51:26.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64461 (GCVE-0-2026-64461)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
PCI: mediatek: Fix IRQ domain leak when port fails to enable
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: mediatek: Fix IRQ domain leak when port fails to enable
When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port
from pcie->ports and frees the port structure. However, the IRQ domains set
up earlier by mtk_pcie_init_irq_domain() are never freed.
Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,
mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when
mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in
the probe error path (during resume, child devices may have active MSI
mappings and the NOIRQ context prohibits sleeping locks),
mtk_pcie_enable_port() is changed to return an error code so callers can
distinguish the two paths and act accordingly.
This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC
support series.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b099631df160ec608cd6147f4d20a8042567a5b8 , < e23da72ef202654a7d5269885c4fa39a8404db76
(git)
Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < ec7c05eed47d8b15c45380aee7ca168a82e15035 (git) Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < 1fbe8972a39548a633d06d7b03a01b7b119a2c12 (git) Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < fe8c701a53c2816cd82301f66c671d952003c1b0 (git) Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < ce52e494a7555bdae1d990a2654fd7547ef6d986 (git) Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < 6e6a529d6f779413379b4404c9ef6a36c0337225 (git) Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e (git) Affected: b099631df160ec608cd6147f4d20a8042567a5b8 , < f865a57896bd92d7662eb2818d8f48872e2cbbc7 (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-mediatek.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e23da72ef202654a7d5269885c4fa39a8404db76",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "ec7c05eed47d8b15c45380aee7ca168a82e15035",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "1fbe8972a39548a633d06d7b03a01b7b119a2c12",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "fe8c701a53c2816cd82301f66c671d952003c1b0",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "ce52e494a7555bdae1d990a2654fd7547ef6d986",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "6e6a529d6f779413379b4404c9ef6a36c0337225",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "f865a57896bd92d7662eb2818d8f48872e2cbbc7",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-mediatek.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Fix IRQ domain leak when port fails to enable\n\nWhen mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port\nfrom pcie-\u003eports and frees the port structure. However, the IRQ domains set\nup earlier by mtk_pcie_init_irq_domain() are never freed.\n\nFix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,\nmtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when\nmtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in\nthe probe error path (during resume, child devices may have active MSI\nmappings and the NOIRQ context prohibits sleeping locks),\nmtk_pcie_enable_port() is changed to return an error code so callers can\ndistinguish the two paths and act accordingly.\n\nThis issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC\nsupport series."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:28.309Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e23da72ef202654a7d5269885c4fa39a8404db76"
},
{
"url": "https://git.kernel.org/stable/c/ec7c05eed47d8b15c45380aee7ca168a82e15035"
},
{
"url": "https://git.kernel.org/stable/c/1fbe8972a39548a633d06d7b03a01b7b119a2c12"
},
{
"url": "https://git.kernel.org/stable/c/fe8c701a53c2816cd82301f66c671d952003c1b0"
},
{
"url": "https://git.kernel.org/stable/c/ce52e494a7555bdae1d990a2654fd7547ef6d986"
},
{
"url": "https://git.kernel.org/stable/c/6e6a529d6f779413379b4404c9ef6a36c0337225"
},
{
"url": "https://git.kernel.org/stable/c/df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e"
},
{
"url": "https://git.kernel.org/stable/c/f865a57896bd92d7662eb2818d8f48872e2cbbc7"
}
],
"title": "PCI: mediatek: Fix IRQ domain leak when port fails to enable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64461",
"datePublished": "2026-07-25T08:51:28.309Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-07-25T08:51:28.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64462 (GCVE-0-2026-64462)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
PCI: altera: Fix resource leaks on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: altera: Fix resource leaks on probe failure
The chained IRQ handler is set during probe, but is only removed during the
driver remove(). If pci_host_probe() fails, the handler and INTx IRQ
domain remain set even though the devm-managed host bridge storage
containing struct altera_pcie will be released, leaving the handler with
a stale data pointer.
Interrupts are also enabled before pci_host_probe() is called. If probe
fails after that point, the controller interrupt source should be disabled
before the chained handler and INTx domain are removed.
So set the chained handler only after the INTx domain has been created.
Disable controller interrupts during IRQ teardown, and tear the IRQ setup
down if pci_host_probe() fails.
[mani: commit log]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c63aed7334c21de8d626ff028ccad98cf5847a0e , < af7cf5d56d7d57c4fbfdb7b5b693790f331b07b7
(git)
Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < 9cf0cc481e1645ec65e61486ae41c486c59781cb (git) Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < 99fc088d6cc6890ae35fa2f29c50ebe027844c20 (git) Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < a25bfa2a6665a1d77324d4a609e7513b87680227 (git) Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < 0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a (git) Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < 09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9 (git) Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < 6864c789b570e57f932847fa83f6b56917182d73 (git) Affected: c63aed7334c21de8d626ff028ccad98cf5847a0e , < 7a94138caeb27f3c49c1dbd93bf422098925bb28 (git) |
|
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-altera.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af7cf5d56d7d57c4fbfdb7b5b693790f331b07b7",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "9cf0cc481e1645ec65e61486ae41c486c59781cb",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "99fc088d6cc6890ae35fa2f29c50ebe027844c20",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "a25bfa2a6665a1d77324d4a609e7513b87680227",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "6864c789b570e57f932847fa83f6b56917182d73",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "7a94138caeb27f3c49c1dbd93bf422098925bb28",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-altera.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: altera: Fix resource leaks on probe failure\n\nThe chained IRQ handler is set during probe, but is only removed during the\ndriver remove(). If pci_host_probe() fails, the handler and INTx IRQ\ndomain remain set even though the devm-managed host bridge storage\ncontaining struct altera_pcie will be released, leaving the handler with\na stale data pointer.\n\nInterrupts are also enabled before pci_host_probe() is called. If probe\nfails after that point, the controller interrupt source should be disabled\nbefore the chained handler and INTx domain are removed.\n\nSo set the chained handler only after the INTx domain has been created.\nDisable controller interrupts during IRQ teardown, and tear the IRQ setup\ndown if pci_host_probe() fails.\n\n[mani: commit log]"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:29.013Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af7cf5d56d7d57c4fbfdb7b5b693790f331b07b7"
},
{
"url": "https://git.kernel.org/stable/c/9cf0cc481e1645ec65e61486ae41c486c59781cb"
},
{
"url": "https://git.kernel.org/stable/c/99fc088d6cc6890ae35fa2f29c50ebe027844c20"
},
{
"url": "https://git.kernel.org/stable/c/a25bfa2a6665a1d77324d4a609e7513b87680227"
},
{
"url": "https://git.kernel.org/stable/c/0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a"
},
{
"url": "https://git.kernel.org/stable/c/09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9"
},
{
"url": "https://git.kernel.org/stable/c/6864c789b570e57f932847fa83f6b56917182d73"
},
{
"url": "https://git.kernel.org/stable/c/7a94138caeb27f3c49c1dbd93bf422098925bb28"
}
],
"title": "PCI: altera: Fix resource leaks on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64462",
"datePublished": "2026-07-25T08:51:29.013Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-07-25T08:51:29.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64465 (GCVE-0-2026-64465)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
When a USB device with active stream endpoints is disconnected,
xhci_free_streams() is called from the hub_event workqueue to
free the stream resources. It calls xhci_free_stream_info()
while holding xhci->lock with irqs disabled.
xhci_free_stream_info() invokes xhci_free_stream_ctx(), which
calls dma_free_coherent() for large stream context arrays.
dma_free_coherent() can sleep (e.g. via vunmap), triggering
a BUG when called from atomic context.
Call trace:
dma_free_attrs+0x174/0x220
xhci_free_stream_info+0xd0/0x11c
xhci_free_streams+0x278/0x37c
usb_free_streams+0x98/0xc0
usb_unbind_interface+0x1b8/0x2f8
device_release_driver_internal+0x1d4/0x2cc
device_release_driver+0x18/0x28
bus_remove_device+0x160/0x1a4
device_del+0x1ec/0x350
usb_disable_device+0x98/0x214
usb_disconnect+0xf0/0x35c
hub_event+0xab4/0x19ec
process_one_work+0x278/0x63c
Fix this by saving the stream_info pointers and clearing the
ep references under the lock, then calling xhci_free_stream_info()
outside the lock where sleeping is allowed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8df75f42f8e67e2851cdcf6da91640fb881defd1 , < e623e4a203f56d5c57519a9a3cb29600551534ad
(git)
Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < d107eb316144c5fb958486e7fe604cd7f1b35cda (git) Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < 1e45aa722c4ce5663e987102aac18c8ad6a83fdd (git) Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < 10666ac9c552990204e791af653abf8e9d9ff619 (git) Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < f7b022ae07685e7526fc39f387ce65b5d309dd3b (git) Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < f90586129cf9e1fbdb718ef602eea3f15dc1c31c (git) Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < 93cd037da94fcb93183bfb2457e3a56d3eb4c8f4 (git) Affected: 8df75f42f8e67e2851cdcf6da91640fb881defd1 , < 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a (git) |
|
| Linux | Linux |
Affected:
2.6.35
Unaffected: 0 , < 2.6.35 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e623e4a203f56d5c57519a9a3cb29600551534ad",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "d107eb316144c5fb958486e7fe604cd7f1b35cda",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "1e45aa722c4ce5663e987102aac18c8ad6a83fdd",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "10666ac9c552990204e791af653abf8e9d9ff619",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "f7b022ae07685e7526fc39f387ce65b5d309dd3b",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "f90586129cf9e1fbdb718ef602eea3f15dc1c31c",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "93cd037da94fcb93183bfb2457e3a56d3eb4c8f4",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
},
{
"lessThan": "42c37c4b75d38b51d84f31a8e29427f5e06a7c2a",
"status": "affected",
"version": "8df75f42f8e67e2851cdcf6da91640fb881defd1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix sleep in atomic context in xhci_free_streams()\n\nWhen a USB device with active stream endpoints is disconnected,\nxhci_free_streams() is called from the hub_event workqueue to\nfree the stream resources. It calls xhci_free_stream_info()\nwhile holding xhci-\u003elock with irqs disabled.\n\nxhci_free_stream_info() invokes xhci_free_stream_ctx(), which\ncalls dma_free_coherent() for large stream context arrays.\n\ndma_free_coherent() can sleep (e.g. via vunmap), triggering\na BUG when called from atomic context.\n\nCall trace:\n dma_free_attrs+0x174/0x220\n xhci_free_stream_info+0xd0/0x11c\n xhci_free_streams+0x278/0x37c\n usb_free_streams+0x98/0xc0\n usb_unbind_interface+0x1b8/0x2f8\n device_release_driver_internal+0x1d4/0x2cc\n device_release_driver+0x18/0x28\n bus_remove_device+0x160/0x1a4\n device_del+0x1ec/0x350\n usb_disable_device+0x98/0x214\n usb_disconnect+0xf0/0x35c\n hub_event+0xab4/0x19ec\n process_one_work+0x278/0x63c\n\nFix this by saving the stream_info pointers and clearing the\nep references under the lock, then calling xhci_free_stream_info()\noutside the lock where sleeping is allowed."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:31.160Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad"
},
{
"url": "https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda"
},
{
"url": "https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd"
},
{
"url": "https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619"
},
{
"url": "https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b"
},
{
"url": "https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c"
},
{
"url": "https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4"
},
{
"url": "https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a"
}
],
"title": "usb: xhci: Fix sleep in atomic context in xhci_free_streams()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64465",
"datePublished": "2026-07-25T08:51:31.160Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-07-25T08:51:31.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64468 (GCVE-0-2026-64468)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
binder: fix UAF in binder_free_transaction()
Summary
In the Linux kernel, the following vulnerability has been resolved:
binder: fix UAF in binder_free_transaction()
In binder_free_transaction(), the t->to_proc is read under the t->lock.
However, once the t->lock is dropped, the to_proc can die in parallel.
This leads to a use-after-free error when we attempt to acquire its
inner lock right afterwards:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0
Write of size 4 at addr ffff00001125da70 by task B/672
CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x1a0
binder_free_transaction+0x8c/0x320
binder_send_failed_reply+0x21c/0x2f8
binder_thread_release+0x488/0x7e0
binder_ioctl+0x12c0/0x29a0
[...]
Allocated by task 675:
__kmalloc_cache_noprof+0x174/0x444
binder_open+0x118/0xb70
do_dentry_open+0x374/0x1040
vfs_open+0x58/0x3bc
[...]
Freed by task 212:
__kasan_slab_free+0x58/0x80
kfree+0x1a0/0x4a4
binder_proc_dec_tmpref+0x32c/0x5e0
binder_deferred_func+0xc48/0x104c
process_one_work+0x53c/0xbc0
[...]
==================================================================
To prevent this, pin the target thread (t->to_thread) to guarantee the
target process remains alive. Undelivered transactions without a target
thread are already safe, as the target process can only be the current
context in those paths.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a370003cc301d4361bae20c9ef615f89bf8d1e8a , < 5602a43f251c3d75312df91a422675fc00ca3dce
(git)
Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < 0be901ab1dcc4af59b88f2e324493bb283850167 (git) Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < 48aeda9f8039e4a6971d1804578efde7f2c01eda (git) Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < 45df558c543bb5543bacc8065fd7c567740781e5 (git) Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < d45ef513eed1abebfec90c3cfb6ae50c2a4182db (git) Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < 328ccf32acb87e8bbb1fe2b065068c574e4db2bf (git) Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < 0f15f0f6ca5df566275ce517f257af2559528b41 (git) Affected: a370003cc301d4361bae20c9ef615f89bf8d1e8a , < f223d27a546c1e1f48d38fd67760e78f068fe8c4 (git) Affected: a4a3c070b8760f71c8311399fa9bfe67c8629bca (git) Affected: 22068d49d09d2b3890e19d7b2048a33340f992da (git) Affected: 0e3b977a8f1be01dcfa0baae68851b1f55f2a0a9 (git) Affected: 4.14.136 , < 4.15 (semver) Affected: 4.19.64 , < 4.20 (semver) Affected: 5.1.15 , < 5.2 (semver) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5602a43f251c3d75312df91a422675fc00ca3dce",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "0be901ab1dcc4af59b88f2e324493bb283850167",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "48aeda9f8039e4a6971d1804578efde7f2c01eda",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "45df558c543bb5543bacc8065fd7c567740781e5",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "d45ef513eed1abebfec90c3cfb6ae50c2a4182db",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "328ccf32acb87e8bbb1fe2b065068c574e4db2bf",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "0f15f0f6ca5df566275ce517f257af2559528b41",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"lessThan": "f223d27a546c1e1f48d38fd67760e78f068fe8c4",
"status": "affected",
"version": "a370003cc301d4361bae20c9ef615f89bf8d1e8a",
"versionType": "git"
},
{
"status": "affected",
"version": "a4a3c070b8760f71c8311399fa9bfe67c8629bca",
"versionType": "git"
},
{
"status": "affected",
"version": "22068d49d09d2b3890e19d7b2048a33340f992da",
"versionType": "git"
},
{
"status": "affected",
"version": "0e3b977a8f1be01dcfa0baae68851b1f55f2a0a9",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.136",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.64",
"versionType": "semver"
},
{
"lessThan": "5.2",
"status": "affected",
"version": "5.1.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.1.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_free_transaction()\n\nIn binder_free_transaction(), the t-\u003eto_proc is read under the t-\u003elock.\nHowever, once the t-\u003elock is dropped, the to_proc can die in parallel.\nThis leads to a use-after-free error when we attempt to acquire its\ninner lock right afterwards:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0\n Write of size 4 at addr ffff00001125da70 by task B/672\n\n CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n _raw_spin_lock+0xe4/0x1a0\n binder_free_transaction+0x8c/0x320\n binder_send_failed_reply+0x21c/0x2f8\n binder_thread_release+0x488/0x7e0\n binder_ioctl+0x12c0/0x29a0\n [...]\n\n Allocated by task 675:\n __kmalloc_cache_noprof+0x174/0x444\n binder_open+0x118/0xb70\n do_dentry_open+0x374/0x1040\n vfs_open+0x58/0x3bc\n [...]\n\n Freed by task 212:\n __kasan_slab_free+0x58/0x80\n kfree+0x1a0/0x4a4\n binder_proc_dec_tmpref+0x32c/0x5e0\n binder_deferred_func+0xc48/0x104c\n process_one_work+0x53c/0xbc0\n [...]\n ==================================================================\n\nTo prevent this, pin the target thread (t-\u003eto_thread) to guarantee the\ntarget process remains alive. Undelivered transactions without a target\nthread are already safe, as the target process can only be the current\ncontext in those paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through Binder device ioctls, including BINDER_WRITE_READ and BINDER_THREAD_EXIT, so the attacker requires local execution.\nAC:L - Attacker-controlled processes can construct the transaction stack and concurrently trigger both thread and target-process teardown, allowing repeated race attempts and heap spraying.\nPR:L - A basic unprivileged user can access an available Binder device or mount a private BinderFS instance through a user namespace; no capability in the initial user namespace is required.\nUI:N - All required transactions, thread exits, and process teardown can be performed by attacker-controlled processes without victim action.\nS:U - Exploitation affects the host kernel within its existing security authority, making this a standard local kernel privilege escalation with unchanged scope.\nC:H - The freed binder_proc can be reclaimed with attacker-influenced data, and subsequent stale-pointer dereferences can provide kernel-memory access and disclosure primitives.\nI:H - The UAF performs spinlock and counter writes into freed slab memory and may operate on a reclaimed waitqueue, enabling heap corruption and potential arbitrary kernel code execution.\nA:H - The demonstrated invalid spinlock write causes a KASAN UAF, and exploitation can otherwise produce a kernel crash, panic, or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:21.553Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce"
},
{
"url": "https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167"
},
{
"url": "https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda"
},
{
"url": "https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5"
},
{
"url": "https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db"
},
{
"url": "https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf"
},
{
"url": "https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41"
},
{
"url": "https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4"
}
],
"title": "binder: fix UAF in binder_free_transaction()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64468",
"datePublished": "2026-07-25T08:51:33.364Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-08-05T12:42:21.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64469 (GCVE-0-2026-64469)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
binder: fix UAF in binder_thread_release()
Summary
In the Linux kernel, the following vulnerability has been resolved:
binder: fix UAF in binder_thread_release()
When a thread exits, binder_thread_release() walks its transaction stack
to clear the t->from and t->to_proc that correspond with the exiting
thread. However, a process dying in parallel might attempt to kfree some
of these transactions. And if one of them has no associated t->to_proc,
the t->to_proc->inner_lock will not be acquired.
This means that transaction accesses in binder_thread_release() after
t->to_proc has been cleared might race with binder_free_transaction()
and cause a use-after-free error as reported by KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798
Write of size 8 at addr ffff000016627500 by task X/715
CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT
Hardware name: linux,dummy-virt (DT)
Call trace:
binder_thread_release+0x5d0/0x798
binder_ioctl+0x12c0/0x299c
[...]
Allocated by task 717 on cpu 18 at 67.267803s:
__kasan_kmalloc+0xa0/0xbc
__kmalloc_cache_noprof+0x174/0x444
binder_transaction+0x554/0x8150
binder_thread_write+0xa30/0x4354
binder_ioctl+0x20f0/0x299c
[...]
Freed by task 202 on cpu 18 at 90.416221s:
__kasan_slab_free+0x58/0x80
kfree+0x1a0/0x4a4
binder_free_transaction+0x150/0x294
binder_send_failed_reply+0x398/0x6d8
binder_release_work+0x3e4/0x4ec
binder_deferred_func+0xbd8/0x104c
[...]
==================================================================
In order to avoid this, make sure that binder_free_transaction() reads
the t->to_proc under the transaction lock. This will serialize the
transaction release with the accesses in binder_thread_release(). Plus,
it matches the documented locking rules for @to_proc.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7a4408c6bd3eb1dafba67986259191be081e3efb , < 1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082
(git)
Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < df1a17abba8d6fac5f965adcb8113ceace6e4949 (git) Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < 38e1a71728e5795b670cc159c18e286a40aeebb4 (git) Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < faa070c7ad8ba25dcd0b12d7cdbb419e336f5391 (git) Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < e63032dc715026a96bcaa13d375a8e15c91caa84 (git) Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < ea02df466df60ecd758eb3b4df3f0cadc5c886ce (git) Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < ef5439ba5b9ac93349f5df12ef88b42a0ce26340 (git) Affected: 7a4408c6bd3eb1dafba67986259191be081e3efb , < 114a116aaa5f0295376cdf12da743c5bce3b20ce (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "df1a17abba8d6fac5f965adcb8113ceace6e4949",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "38e1a71728e5795b670cc159c18e286a40aeebb4",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "faa070c7ad8ba25dcd0b12d7cdbb419e336f5391",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "e63032dc715026a96bcaa13d375a8e15c91caa84",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "ea02df466df60ecd758eb3b4df3f0cadc5c886ce",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "ef5439ba5b9ac93349f5df12ef88b42a0ce26340",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
},
{
"lessThan": "114a116aaa5f0295376cdf12da743c5bce3b20ce",
"status": "affected",
"version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_thread_release()\n\nWhen a thread exits, binder_thread_release() walks its transaction stack\nto clear the t-\u003efrom and t-\u003eto_proc that correspond with the exiting\nthread. However, a process dying in parallel might attempt to kfree some\nof these transactions. And if one of them has no associated t-\u003eto_proc,\nthe t-\u003eto_proc-\u003einner_lock will not be acquired.\n\nThis means that transaction accesses in binder_thread_release() after\nt-\u003eto_proc has been cleared might race with binder_free_transaction()\nand cause a use-after-free error as reported by KASAN:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798\n Write of size 8 at addr ffff000016627500 by task X/715\n\n CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n binder_thread_release+0x5d0/0x798\n binder_ioctl+0x12c0/0x299c\n [...]\n\n Allocated by task 717 on cpu 18 at 67.267803s:\n __kasan_kmalloc+0xa0/0xbc\n __kmalloc_cache_noprof+0x174/0x444\n binder_transaction+0x554/0x8150\n binder_thread_write+0xa30/0x4354\n binder_ioctl+0x20f0/0x299c\n [...]\n\n Freed by task 202 on cpu 18 at 90.416221s:\n __kasan_slab_free+0x58/0x80\n kfree+0x1a0/0x4a4\n binder_free_transaction+0x150/0x294\n binder_send_failed_reply+0x398/0x6d8\n binder_release_work+0x3e4/0x4ec\n binder_deferred_func+0xbd8/0x104c\n [...]\n ==================================================================\n\nIn order to avoid this, make sure that binder_free_transaction() reads\nthe t-\u003eto_proc under the transaction lock. This will serialize the\ntransaction release with the accesses in binder_thread_release(). Plus,\nit matches the documented locking rules for @to_proc."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation is reached through local Binder device ioctls, including BINDER_WRITE_READ and BINDER_THREAD_EXIT, rather than network input.\nAC:L - The attacker can control the communicating processes, nested synchronous transactions, thread exit, and concurrent target-process death, allowing repeated attempts at the race.\nPR:L - No capability check protects the vulnerable ioctls; ordinary Android applications can access Binder, and unprivileged user-namespace root can create private Binder devices through BinderFS.\nUI:N - The attacker directly creates the transaction stack and triggers both teardown paths without requiring any victim action.\nS:U - Exploitation compromises the kernel hosting the vulnerable Binder subsystem and constitutes standard local privilege escalation within the same security authority.\nC:H - The freed binder_transaction can be reclaimed with attacker-influenced contents, enabling kernel-memory access primitives and ultimately disclosure of arbitrary kernel or process memory.\nI:H - binder_thread_release() continues writing through the freed transaction, including pointer fields and the attacker-influenceable t-\u003ebuffer path, permitting kernel-memory corruption and potential arbitrary write or code execution.\nA:H - The UAF can directly cause a kernel oops or panic and can be triggered repeatedly by an unprivileged local attacker."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:22.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082"
},
{
"url": "https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949"
},
{
"url": "https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4"
},
{
"url": "https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391"
},
{
"url": "https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84"
},
{
"url": "https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce"
},
{
"url": "https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340"
},
{
"url": "https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce"
}
],
"title": "binder: fix UAF in binder_thread_release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64469",
"datePublished": "2026-07-25T08:51:34.025Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-08-05T12:42:22.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…