Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0982
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.262-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
},
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.180-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64376"
},
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-64275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64275"
},
{
"name": "CVE-2026-64274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64274"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64452"
},
{
"name": "CVE-2026-64483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64483"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-64409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64409"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-64489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64489"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64480"
},
{
"name": "CVE-2026-64399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64399"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-64454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64454"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2026-53400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
},
{
"name": "CVE-2026-64365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64365"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64514"
},
{
"name": "CVE-2026-64279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64279"
},
{
"name": "CVE-2026-64337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64337"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64430"
},
{
"name": "CVE-2026-64497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64497"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-64276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
},
{
"name": "CVE-2026-64475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64475"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64271"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64455"
},
{
"name": "CVE-2026-52942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52942"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-64445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64445"
},
{
"name": "CVE-2026-64500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64500"
},
{
"name": "CVE-2026-63806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
},
{
"name": "CVE-2026-64330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64330"
},
{
"name": "CVE-2026-64348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64348"
},
{
"name": "CVE-2026-64469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64469"
},
{
"name": "CVE-2026-64362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64362"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-64486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64486"
},
{
"name": "CVE-2026-64446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64446"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64338"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-64536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64536"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-64351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64351"
},
{
"name": "CVE-2026-23204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-64432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64432"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-53332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53332"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64296"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64370"
},
{
"name": "CVE-2026-43216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43216"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-64299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64299"
},
{
"name": "CVE-2026-64374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64374"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64345"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-64504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64504"
},
{
"name": "CVE-2026-64398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64398"
},
{
"name": "CVE-2026-64297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64297"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-64397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64397"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-64468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64468"
},
{
"name": "CVE-2026-64449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64449"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-63797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
},
{
"name": "CVE-2026-64456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64456"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64465"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-64442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64442"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64248"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64458"
},
{
"name": "CVE-2026-64476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64476"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-64318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64318"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-64394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64394"
},
{
"name": "CVE-2026-53177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-64435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64435"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64336"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64346"
},
{
"name": "CVE-2026-31610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31610"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-64342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64342"
},
{
"name": "CVE-2026-64360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64360"
},
{
"name": "CVE-2022-50114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50114"
},
{
"name": "CVE-2026-64478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64478"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64437"
},
{
"name": "CVE-2026-64335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64335"
},
{
"name": "CVE-2026-64301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64301"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-64395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64395"
},
{
"name": "CVE-2026-64273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64273"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2024-36013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36013"
},
{
"name": "CVE-2025-40196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40196"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-46135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46135"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-53393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
},
{
"name": "CVE-2026-64496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64496"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-64316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64316"
},
{
"name": "CVE-2026-64417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64417"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-64443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64443"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-64269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64269"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64482"
},
{
"name": "CVE-2026-64495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64495"
},
{
"name": "CVE-2026-64396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64396"
},
{
"name": "CVE-2026-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64324"
},
{
"name": "CVE-2026-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64329"
},
{
"name": "CVE-2026-64373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64373"
},
{
"name": "CVE-2026-64277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
},
{
"name": "CVE-2026-64503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64503"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-64403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64403"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-64487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64487"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-64429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64429"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-64350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64350"
},
{
"name": "CVE-2026-64250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64250"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-64448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64448"
},
{
"name": "CVE-2026-64347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64347"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2026-64393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64393"
},
{
"name": "CVE-2026-64419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64419"
},
{
"name": "CVE-2026-64372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64372"
},
{
"name": "CVE-2026-64444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64444"
},
{
"name": "CVE-2022-49803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49803"
},
{
"name": "CVE-2026-64331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64331"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64494"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64379"
},
{
"name": "CVE-2026-64420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64420"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
},
{
"name": "CVE-2026-64425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64425"
},
{
"name": "CVE-2026-64600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64600"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64505"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-64422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64422"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64484"
},
{
"name": "CVE-2026-64298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2023-52494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52494"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
},
{
"name": "CVE-2026-63829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
},
{
"name": "CVE-2026-64440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64440"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
},
{
"name": "CVE-2026-64359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64359"
},
{
"name": "CVE-2026-43219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43219"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0982",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00007",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00007.html"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00008",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00008.html"
}
]
}
CVE-2026-64470 (GCVE-0-2026-64470)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
Bluetooth: btusb: fix use-after-free on marvell probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: fix use-after-free on marvell probe failure
Make sure to stop any TX URBs submitted during Marvell OOB wakeup
configuration on later probe failures to avoid use-after-free in the
completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < 1edd524de5cc8143ece9c42c466346983dc5b5ed
(git)
Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < 0ccb1cb0a464dab78284c34196cd3e8e18bab4c4 (git) Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < 631de465aba7f8ae46478bf5f598111412e8eff8 (git) Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < 6e1b10df890f4663cb38af9fc1c93d36747b75af (git) Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < 92c736866244340497a8a65afe2ac25354c2bf5e (git) Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < a7e941a395711791c7e98d9870c6562c2c9e9ef2 (git) Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < 838c917a2f16eefe68def800ebf48a2af591149a (git) Affected: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac , < c5b600a3c05b1a7a110d558df935a8fc8a471c79 (git) |
|
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1edd524de5cc8143ece9c42c466346983dc5b5ed",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "0ccb1cb0a464dab78284c34196cd3e8e18bab4c4",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "631de465aba7f8ae46478bf5f598111412e8eff8",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "6e1b10df890f4663cb38af9fc1c93d36747b75af",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "92c736866244340497a8a65afe2ac25354c2bf5e",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "a7e941a395711791c7e98d9870c6562c2c9e9ef2",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "838c917a2f16eefe68def800ebf48a2af591149a",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "c5b600a3c05b1a7a110d558df935a8fc8a471c79",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: fix use-after-free on marvell probe failure\n\nMake sure to stop any TX URBs submitted during Marvell OOB wakeup\nconfiguration on later probe failures to avoid use-after-free in the\ncompletion callback.\n\nThis issue was reported by Sashiko while reviewing a fix for a wakeup\nsource leak in the btusb probe errors paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:34.673Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1edd524de5cc8143ece9c42c466346983dc5b5ed"
},
{
"url": "https://git.kernel.org/stable/c/0ccb1cb0a464dab78284c34196cd3e8e18bab4c4"
},
{
"url": "https://git.kernel.org/stable/c/631de465aba7f8ae46478bf5f598111412e8eff8"
},
{
"url": "https://git.kernel.org/stable/c/6e1b10df890f4663cb38af9fc1c93d36747b75af"
},
{
"url": "https://git.kernel.org/stable/c/92c736866244340497a8a65afe2ac25354c2bf5e"
},
{
"url": "https://git.kernel.org/stable/c/a7e941a395711791c7e98d9870c6562c2c9e9ef2"
},
{
"url": "https://git.kernel.org/stable/c/838c917a2f16eefe68def800ebf48a2af591149a"
},
{
"url": "https://git.kernel.org/stable/c/c5b600a3c05b1a7a110d558df935a8fc8a471c79"
}
],
"title": "Bluetooth: btusb: fix use-after-free on marvell probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64470",
"datePublished": "2026-07-25T08:51:34.673Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-07-25T08:51:34.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64471 (GCVE-0-2026-64471)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
Bluetooth: btusb: fix use-after-free on registration failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: fix use-after-free on registration failure
Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9bfa35fe422c74882e27cc54450a5f76c96aad68 , < e09ac7d0c6859a360bf36e7104aef03f88184e0b
(git)
Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < 468fcdfaeb937163dd250773a9fed17ab1fa203c (git) Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < 1ce5012944afaddbda939ec6bae9800fce84abbc (git) Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < e6313b800da61a26c2fdd5eba0105e197c0ab3bc (git) Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < 14e02f1449ba425a44dedbec9a21efafb056e09f (git) Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < 8db0ce3de78367f61c2970c0f16d9adee8830a23 (git) Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < da7d7758fe884b256ddc9fef562e5ddef7952383 (git) Affected: 9bfa35fe422c74882e27cc54450a5f76c96aad68 , < eedc6867ebad73edbfaf9a0a65fbef7115cc4753 (git) |
|
| Linux | Linux |
Affected:
2.6.27
Unaffected: 0 , < 2.6.27 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e09ac7d0c6859a360bf36e7104aef03f88184e0b",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "468fcdfaeb937163dd250773a9fed17ab1fa203c",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "1ce5012944afaddbda939ec6bae9800fce84abbc",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "e6313b800da61a26c2fdd5eba0105e197c0ab3bc",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "14e02f1449ba425a44dedbec9a21efafb056e09f",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "8db0ce3de78367f61c2970c0f16d9adee8830a23",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "da7d7758fe884b256ddc9fef562e5ddef7952383",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "eedc6867ebad73edbfaf9a0a65fbef7115cc4753",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: fix use-after-free on registration failure\n\nMake sure to release the sibling interfaces in case controller\nregistration fails to avoid use-after-free and double-free when they are\neventually disconnected.\n\nThis issue was reported by Sashiko while reviewing a fix for a wakeup\nsource leak in the btusb probe errors paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:35.245Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b"
},
{
"url": "https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c"
},
{
"url": "https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc"
},
{
"url": "https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc"
},
{
"url": "https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f"
},
{
"url": "https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23"
},
{
"url": "https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383"
},
{
"url": "https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753"
}
],
"title": "Bluetooth: btusb: fix use-after-free on registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64471",
"datePublished": "2026-07-25T08:51:35.245Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-07-25T08:51:35.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64472 (GCVE-0-2026-64472)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
vfio/mlx5: Fix racy bitfields and tighten struct layout
Summary
In the Linux kernel, the following vulnerability has been resolved:
vfio/mlx5: Fix racy bitfields and tighten struct layout
Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.
This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.
Note mlx5_vhca_page_tracker.status is relocated to fill the alignment
hole this split exposes.
Bitfield justifications:
migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe
chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe
mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe
Dedicated storage units:
mdev_detach: written in the VF attach/detach event notifier
mlx5fv_vf_event() at runtime
log_active: written in mlx5vf_start_page_tracker()/
mlx5vf_stop_page_tracker() during runtime dirty tracking
deferred_reset: written in mlx5vf_state_mutex_unlock()/
mlx5vf_pci_aer_reset_done() during runtime reset handling
is_err: set by tracker error handling and dirty-log polling at runtime
object_changed: set by tracker event handling and cleared by dirty-log
polling at runtime
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 1dd99b8f4e143592e12e5a77e7b538bc698116cb
(git)
Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < f1db80a67da928a92ba460ede1be52d8941f46be (git) Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 399d806f998f7a25405fc1b97227e579aead24af (git) Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 7ed120b1a007bace57c461805519d70e1af44e59 (git) Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 39d163627b51886492bf31f66cb02c94613d2287 (git) Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < f2365a63b02ddea32e7db78b742c2503ec7b81f1 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/mlx5/cmd.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1dd99b8f4e143592e12e5a77e7b538bc698116cb",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "f1db80a67da928a92ba460ede1be52d8941f46be",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "399d806f998f7a25405fc1b97227e579aead24af",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "7ed120b1a007bace57c461805519d70e1af44e59",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "39d163627b51886492bf31f66cb02c94613d2287",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "f2365a63b02ddea32e7db78b742c2503ec7b81f1",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/mlx5/cmd.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix racy bitfields and tighten struct layout\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote mlx5_vhca_page_tracker.status is relocated to fill the alignment\nhole this split exposes.\n\nBitfield justifications:\n\n migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe\n chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe\n mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe\n\nDedicated storage units:\n\n mdev_detach: written in the VF attach/detach event notifier\n mlx5fv_vf_event() at runtime\n log_active: written in mlx5vf_start_page_tracker()/\n mlx5vf_stop_page_tracker() during runtime dirty tracking\n deferred_reset: written in mlx5vf_state_mutex_unlock()/\n mlx5vf_pci_aer_reset_done() during runtime reset handling\n is_err: set by tracker error handling and dirty-log polling at runtime\n object_changed: set by tracker event handling and cleared by dirty-log\n polling at runtime"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:35.978Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb"
},
{
"url": "https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be"
},
{
"url": "https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af"
},
{
"url": "https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59"
},
{
"url": "https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287"
},
{
"url": "https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1"
}
],
"title": "vfio/mlx5: Fix racy bitfields and tighten struct layout",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64472",
"datePublished": "2026-07-25T08:51:35.978Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-07-25T08:51:35.978Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64475 (GCVE-0-2026-64475)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
vfio/pci: Release the VGA arbiter client on register_device() failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Release the VGA arbiter client on register_device() failure
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
the last failure point of what is now vfio_pci_core_register_device()
without introducing an unwind for the VGA arbiter registration.
In current kernels this is mostly benign because vfio_pci_set_decode()
only uses pci_dev state, but the original failure path could leave a
callback with a freed vdev cookie. The stale registration also becomes
unsafe again once the callback follows drvdata to the vfio device.
Add the required VGA unwind callout.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
87856f9af04eaacf9848710625a4ffee1d020fa9 , < 0f2a35a0c7ea7da347b814750eaa78adf3582381
(git)
Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < 8d65decde9afd2bd78bcfffdc0df73b82a0b5509 (git) Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < ef4c38d30b3744e89eb5048218904bb629ea8d47 (git) Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < 9e0a3f642e607848669235f5069f35640abbfc88 (git) Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < 42d758a09d2c46c42357ecde9a5492f015bde2e5 (git) Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < 52adb2dff7ce3d8430e2bdc5988b618a430def85 (git) Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < 278a5659c391fe5afe5f9ce1bad1fd24e90144f1 (git) Affected: 4aeec3984ddc853f7c65903bde472ffdef738bae , < daedde7f024ecf88bc8e832ed40cf2c795f0796a (git) Affected: d62dccb417cf972c978bf3c68a7d5e846bcf953e (git) Affected: 6694b8daffac5a8661071f085608afc78f7acd08 (git) Affected: 5.10.37 , < 5.10.261 (semver) Affected: 5.11.21 , < 5.12 (semver) Affected: 5.12.4 , < 5.13 (semver) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/vfio_pci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f2a35a0c7ea7da347b814750eaa78adf3582381",
"status": "affected",
"version": "87856f9af04eaacf9848710625a4ffee1d020fa9",
"versionType": "git"
},
{
"lessThan": "8d65decde9afd2bd78bcfffdc0df73b82a0b5509",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"lessThan": "ef4c38d30b3744e89eb5048218904bb629ea8d47",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"lessThan": "9e0a3f642e607848669235f5069f35640abbfc88",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"lessThan": "42d758a09d2c46c42357ecde9a5492f015bde2e5",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"lessThan": "52adb2dff7ce3d8430e2bdc5988b618a430def85",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"lessThan": "278a5659c391fe5afe5f9ce1bad1fd24e90144f1",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"lessThan": "daedde7f024ecf88bc8e832ed40cf2c795f0796a",
"status": "affected",
"version": "4aeec3984ddc853f7c65903bde472ffdef738bae",
"versionType": "git"
},
{
"status": "affected",
"version": "d62dccb417cf972c978bf3c68a7d5e846bcf953e",
"versionType": "git"
},
{
"status": "affected",
"version": "6694b8daffac5a8661071f085608afc78f7acd08",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.37",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.21",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/vfio_pci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Release the VGA arbiter client on register_device() failure\n\nThe re-order in the Fixes commit below displaced vfio_pci_vga_init() as\nthe last failure point of what is now vfio_pci_core_register_device()\nwithout introducing an unwind for the VGA arbiter registration.\n\nIn current kernels this is mostly benign because vfio_pci_set_decode()\nonly uses pci_dev state, but the original failure path could leave a\ncallback with a freed vdev cookie. The stale registration also becomes\nunsafe again once the callback follows drvdata to the vfio device.\n\nAdd the required VGA unwind callout."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is triggered through local `/dev/vga_arbiter` operations or accesses to a delegated VFIO VGA region; it is not directly network-reachable. The VGA-arbiter character-device interface is documented in the [kernel documentation](https://docs.kernel.org/gpu/vgaarbiter.html).\nAC:L - Once failed VFIO registration leaves the stale callback, a single first-use VGA lock or legacy VGA access invokes it. No race must be won, and the attacker controls the triggering access.\nPR:L - The failed bind may arise from boot or privileged orchestration, but the subsequent callback path has no capability check and can be triggered by a video-group user, delegated VFIO process, or VM tenant. Real host-root privileges are therefore not required in a reasonable deployment.\nUI:N - The attacker directly performs the VGA-arbiter or VFIO-region access, with no victim action required during exploitation. Prior system configuration or automated device binding is not user interaction.\nS:C - With VFIO GPU passthrough, QEMU translates guest legacy-VGA accesses into VFIO `pread()` and `pwrite()` operations, allowing a guest to activate the stale host callback and potentially compromise the host kernel across the VM boundary, as shown by [QEMU\u2019s VFIO VGA implementation](https://gitlab.com/qemu-project/qemu/-/blob/e5b3a241 81ea0cebf1c5b20f44d016311b7048f0/hw/vfio/pci.c).\nC:H - Historical affected branches retain a callback cookie pointing to a freed `struct vfio_pci_device`; reclaiming that allocation can control its embedded `pdev` pointer and redirect kernel pointer dereferences. Under conservative UAF assessment, this can enable disclosure of arbitrary host memory.\nI:H - The dangling object and potentially stale module callback create exploitable memory-lifetime corruption that can be heap-shaped toward control-flow hijacking or arbitrary kernel modification. Successful exploitation can therefore execute code in the host kernel.\nA:H - An invalid reclaimed `pdev` or unloaded callback target can immediately produce a kernel page fault, oops, or panic. The trigger requires only one attacker-controlled VGA access after the stale registration exists."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:23.772Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381"
},
{
"url": "https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509"
},
{
"url": "https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47"
},
{
"url": "https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88"
},
{
"url": "https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5"
},
{
"url": "https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85"
},
{
"url": "https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1"
},
{
"url": "https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a"
}
],
"title": "vfio/pci: Release the VGA arbiter client on register_device() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64475",
"datePublished": "2026-07-25T08:51:38.154Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-08-05T12:42:23.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64476 (GCVE-0-2026-64476)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
vfio/pci: Latch disable_idle_d3 per device
Summary
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Latch disable_idle_d3 per device
When disable_idle_d3 was introduced in vfio-pci, it directly manipulated
the device power state with pci_set_power_state(). There were no
refcounts to maintain or balanced operations, we could unconditionally
bring the device to D0 and conditionally move it to D3hot. Therefore
the module parameter was made writable.
Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to
vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect
of the module parameter was nullified. The parameter value could still
be changed through sysfs, but the vfio-pci driver latched the values
into vfio-pci-core globals at module init. Loading the vfio-pci module,
or unloading and reloading, with non-default or different values could
change the globals relative to existing devices bound to vfio-pci
variant drivers.
Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the
unused device into low power state with runtime PM"), which marks the
point where power states became refcounted. PM get and put operations
need to be balanced, but the same module operations noted above can
change the global variables relative to those devices already bound to
vfio-pci variant drivers. This introduces a window where PM operations
can now become unbalanced.
To resolve this with a narrow footprint for stable backports, the
disable_idle_d3 flag is latched into the vfio_pci_core_device at the
time of initialization, such that the device always operates with a
consistent value.
NB. vfio_pci_dev_set_try_reset() now unconditionally raises the
runtime PM usage count around bus reset to account for disable_idle_d3
becoming a per-device rather than global flag. When this flag is set,
the additional get/put pair is harmless and allows continued use of the
shared vfio_pci_dev_set_pm_runtime_get() helper.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7ab5e10eda02da1d9562ffde562c51055d368e9c , < 332d785f9ae426eeeb92527872adf09d84101ba3
(git)
Affected: 7ab5e10eda02da1d9562ffde562c51055d368e9c , < 654710ef3135c4546b20a903bc23a51b0c44d6c8 (git) Affected: 7ab5e10eda02da1d9562ffde562c51055d368e9c , < b98296816d31441b307ef9fa8670dcf5a55e5505 (git) Affected: 7ab5e10eda02da1d9562ffde562c51055d368e9c , < f6c67cf0051f96ba61d186731d3d9409b9927db2 (git) Affected: 7ab5e10eda02da1d9562ffde562c51055d368e9c , < 062b820290bcb9778e43a73597df76e9bb08acfb (git) Affected: 7ab5e10eda02da1d9562ffde562c51055d368e9c , < 4575e9aac5336d1365138c0284773bf8da4b1fa3 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/vfio_pci_core.c",
"include/linux/vfio_pci_core.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "332d785f9ae426eeeb92527872adf09d84101ba3",
"status": "affected",
"version": "7ab5e10eda02da1d9562ffde562c51055d368e9c",
"versionType": "git"
},
{
"lessThan": "654710ef3135c4546b20a903bc23a51b0c44d6c8",
"status": "affected",
"version": "7ab5e10eda02da1d9562ffde562c51055d368e9c",
"versionType": "git"
},
{
"lessThan": "b98296816d31441b307ef9fa8670dcf5a55e5505",
"status": "affected",
"version": "7ab5e10eda02da1d9562ffde562c51055d368e9c",
"versionType": "git"
},
{
"lessThan": "f6c67cf0051f96ba61d186731d3d9409b9927db2",
"status": "affected",
"version": "7ab5e10eda02da1d9562ffde562c51055d368e9c",
"versionType": "git"
},
{
"lessThan": "062b820290bcb9778e43a73597df76e9bb08acfb",
"status": "affected",
"version": "7ab5e10eda02da1d9562ffde562c51055d368e9c",
"versionType": "git"
},
{
"lessThan": "4575e9aac5336d1365138c0284773bf8da4b1fa3",
"status": "affected",
"version": "7ab5e10eda02da1d9562ffde562c51055d368e9c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/vfio_pci_core.c",
"include/linux/vfio_pci_core.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Latch disable_idle_d3 per device\n\nWhen disable_idle_d3 was introduced in vfio-pci, it directly manipulated\nthe device power state with pci_set_power_state(). There were no\nrefcounts to maintain or balanced operations, we could unconditionally\nbring the device to D0 and conditionally move it to D3hot. Therefore\nthe module parameter was made writable.\n\nLater, in commit c61302aa48f7 (\"vfio/pci: Move module parameters to\nvfio_pci.c\"), as part of the vfio-pci-core split, the writable aspect\nof the module parameter was nullified. The parameter value could still\nbe changed through sysfs, but the vfio-pci driver latched the values\ninto vfio-pci-core globals at module init. Loading the vfio-pci module,\nor unloading and reloading, with non-default or different values could\nchange the globals relative to existing devices bound to vfio-pci\nvariant drivers.\n\nRuntime PM was introduced in commit 7ab5e10eda02 (\"vfio/pci: Move the\nunused device into low power state with runtime PM\"), which marks the\npoint where power states became refcounted. PM get and put operations\nneed to be balanced, but the same module operations noted above can\nchange the global variables relative to those devices already bound to\nvfio-pci variant drivers. This introduces a window where PM operations\ncan now become unbalanced.\n\nTo resolve this with a narrow footprint for stable backports, the\ndisable_idle_d3 flag is latched into the vfio_pci_core_device at the\ntime of initialization, such that the device always operates with a\nconsistent value.\n\nNB. vfio_pci_dev_set_try_reset() now unconditionally raises the\nruntime PM usage count around bus reset to account for disable_idle_d3\nbecoming a per-device rather than global flag. When this flag is set,\nthe additional get/put pair is harmless and allows continued use of the\nshared vfio_pci_dev_set_pm_runtime_get() helper."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:38.865Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3"
},
{
"url": "https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8"
},
{
"url": "https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505"
},
{
"url": "https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2"
},
{
"url": "https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb"
},
{
"url": "https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3"
}
],
"title": "vfio/pci: Latch disable_idle_d3 per device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64476",
"datePublished": "2026-07-25T08:51:38.865Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-07-25T08:51:38.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64478 (GCVE-0-2026-64478)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: usb-audio: avoid kobject path lookup in DualSense match
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: avoid kobject path lookup in DualSense match
The DualSense jack-detection input handler verifies that a matching input
device belongs to the same physical controller by building kobject path
strings for both the input device and the USB audio device, then comparing
the path prefix.
This was observed when a weak physical connection caused the controller
to rapidly disconnect and reconnect. During that repeated hotplug,
snd_dualsense_ih_match() can run while the controller's USB device is
being disconnected. kobject_get_path() walks ancestor kobjects and
dereferences their names; if the USB device kobject name is no longer
valid, this can fault in strlen():
RIP: 0010:strlen+0x10/0x30
Call Trace:
kobject_get_path+0x34/0x150
snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
input_register_device+0x566/0x6a0
ps_probe+0xb89/0x1590 [hid_playstation]
The same ownership check can be done without building kobject path
strings. The input device is parented below the HID device, USB interface
and USB device, so walking the input device parent chain and comparing
against the mixer USB device preserves the check without dereferencing
kobject names during disconnect.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d0b0264009596c07a77d82808b0dae72bc04ac5c , < e4c66a149c408e44e60bfec3fabf08b6b7abbc60
(git)
Affected: b4b94f092f193d7a2db8e82af5e51519ae89963c , < 4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e (git) Affected: c2d5b0a6c688ffb32c35627e337fbbcc65bc275f , < 662a1d7b5affc424ea4f4bc20dd99be29e687886 (git) Affected: d04d301614630724feb4048bf17432fc7964fe74 , < a47ecd904c51ae6a42957feb3cf2f4266adee2e5 (git) Affected: a705899ec6085b12a33aa0fd94a58e82e9e90502 , < c1da6d3f45036fa63672ee04ad97cb526b40b987 (git) Affected: 79d561c4ec0497669f19a9550cfb74812f60938b , < a263eb12cbe2e208e6e637df0f9b0be9a484158e (git) Affected: 79d561c4ec0497669f19a9550cfb74812f60938b , < 4246dd043b7a4f8e3bc1d2896e81d11220610eda (git) Affected: 79d561c4ec0497669f19a9550cfb74812f60938b , < 7693c0cc415f3a16a7a3355f245474a5e661be4e (git) Affected: 104ad9bae11ee450fb7d0595ff7876cfb6527838 (git) Affected: 0105cfc41abeb428d4405951a20e1e239bea5e1d (git) Affected: 5.10.245 , < 5.10.261 (semver) Affected: 5.15.194 , < 5.15.212 (semver) Affected: 6.1.155 , < 6.1.178 (semver) Affected: 6.6.109 , < 6.6.145 (semver) Affected: 6.12.50 , < 6.12.96 (semver) Affected: 5.4.300 , < 5.5 (semver) Affected: 6.16.10 , < 6.17 (semver) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_quirks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4c66a149c408e44e60bfec3fabf08b6b7abbc60",
"status": "affected",
"version": "d0b0264009596c07a77d82808b0dae72bc04ac5c",
"versionType": "git"
},
{
"lessThan": "4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e",
"status": "affected",
"version": "b4b94f092f193d7a2db8e82af5e51519ae89963c",
"versionType": "git"
},
{
"lessThan": "662a1d7b5affc424ea4f4bc20dd99be29e687886",
"status": "affected",
"version": "c2d5b0a6c688ffb32c35627e337fbbcc65bc275f",
"versionType": "git"
},
{
"lessThan": "a47ecd904c51ae6a42957feb3cf2f4266adee2e5",
"status": "affected",
"version": "d04d301614630724feb4048bf17432fc7964fe74",
"versionType": "git"
},
{
"lessThan": "c1da6d3f45036fa63672ee04ad97cb526b40b987",
"status": "affected",
"version": "a705899ec6085b12a33aa0fd94a58e82e9e90502",
"versionType": "git"
},
{
"lessThan": "a263eb12cbe2e208e6e637df0f9b0be9a484158e",
"status": "affected",
"version": "79d561c4ec0497669f19a9550cfb74812f60938b",
"versionType": "git"
},
{
"lessThan": "4246dd043b7a4f8e3bc1d2896e81d11220610eda",
"status": "affected",
"version": "79d561c4ec0497669f19a9550cfb74812f60938b",
"versionType": "git"
},
{
"lessThan": "7693c0cc415f3a16a7a3355f245474a5e661be4e",
"status": "affected",
"version": "79d561c4ec0497669f19a9550cfb74812f60938b",
"versionType": "git"
},
{
"status": "affected",
"version": "104ad9bae11ee450fb7d0595ff7876cfb6527838",
"versionType": "git"
},
{
"status": "affected",
"version": "0105cfc41abeb428d4405951a20e1e239bea5e1d",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.155",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.109",
"versionType": "semver"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "6.12.50",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.300",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_quirks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.155",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.109",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.300",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: avoid kobject path lookup in DualSense match\n\nThe DualSense jack-detection input handler verifies that a matching input\ndevice belongs to the same physical controller by building kobject path\nstrings for both the input device and the USB audio device, then comparing\nthe path prefix.\n\nThis was observed when a weak physical connection caused the controller\nto rapidly disconnect and reconnect. During that repeated hotplug,\nsnd_dualsense_ih_match() can run while the controller\u0027s USB device is\nbeing disconnected. kobject_get_path() walks ancestor kobjects and\ndereferences their names; if the USB device kobject name is no longer\nvalid, this can fault in strlen():\n\n RIP: 0010:strlen+0x10/0x30\n Call Trace:\n kobject_get_path+0x34/0x150\n snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]\n input_register_device+0x566/0x6a0\n ps_probe+0xb89/0x1590 [hid_playstation]\n\nThe same ownership check can be done without building kobject path\nstrings. The input device is parented below the HID device, USB interface\nand USB device, so walking the input device parent chain and comparing\nagainst the mixer USB device preserves the check without dereferencing\nkobject names during disconnect."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:40.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60"
},
{
"url": "https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e"
},
{
"url": "https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886"
},
{
"url": "https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5"
},
{
"url": "https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987"
},
{
"url": "https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e"
},
{
"url": "https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda"
},
{
"url": "https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e"
}
],
"title": "ALSA: usb-audio: avoid kobject path lookup in DualSense match",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64478",
"datePublished": "2026-07-25T08:51:40.299Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-07-25T08:51:40.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64480 (GCVE-0-2026-64480)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: ice1712: check snd_ctl_new1() return value
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ice1712: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails. The
ice1712 driver calls snd_ctl_new1() without checking the return value
before dereferencing the pointer in multiple places (ice1712.c,
ice1724.c, aureon.c), which can lead to NULL pointer dereferences.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0df0097ea2d52401c31e550389ac758c90e6a1eb , < 57d59be545b309d4bb54ac472b15d1e67f254d95
(git)
Affected: b9a4efd61b6b9f62f83752959e75a5dae20624fa , < 69bf1dfa3215524c4ae255bb9dce0770875abbeb (git) Affected: b9a4efd61b6b9f62f83752959e75a5dae20624fa , < d34ad480b8896d2b486e2cf29ce1790326cad205 (git) Affected: b9a4efd61b6b9f62f83752959e75a5dae20624fa , < 71b87108ad93d433cdb20704a8dc8852304cf2c2 (git) Affected: b9a4efd61b6b9f62f83752959e75a5dae20624fa , < 38a7cc46370a57122fb29c4bfe48a851c0c64459 (git) Affected: b9a4efd61b6b9f62f83752959e75a5dae20624fa , < 2b929b91b0f3bc6de8a844370049cd99ee8e31ff (git) Affected: 286e17a1c3baeb1b1cd36b63ee16e8a6e63d558e (git) Affected: 6.1.34 , < 6.1.178 (semver) Affected: 6.3.8 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/ice1712/aureon.c",
"sound/pci/ice1712/ice1712.c",
"sound/pci/ice1712/ice1724.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57d59be545b309d4bb54ac472b15d1e67f254d95",
"status": "affected",
"version": "0df0097ea2d52401c31e550389ac758c90e6a1eb",
"versionType": "git"
},
{
"lessThan": "69bf1dfa3215524c4ae255bb9dce0770875abbeb",
"status": "affected",
"version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
"versionType": "git"
},
{
"lessThan": "d34ad480b8896d2b486e2cf29ce1790326cad205",
"status": "affected",
"version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
"versionType": "git"
},
{
"lessThan": "71b87108ad93d433cdb20704a8dc8852304cf2c2",
"status": "affected",
"version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
"versionType": "git"
},
{
"lessThan": "38a7cc46370a57122fb29c4bfe48a851c0c64459",
"status": "affected",
"version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
"versionType": "git"
},
{
"lessThan": "2b929b91b0f3bc6de8a844370049cd99ee8e31ff",
"status": "affected",
"version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
"versionType": "git"
},
{
"status": "affected",
"version": "286e17a1c3baeb1b1cd36b63ee16e8a6e63d558e",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.34",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/ice1712/aureon.c",
"sound/pci/ice1712/ice1712.c",
"sound/pci/ice1712/ice1724.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ice1712: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails. The\nice1712 driver calls snd_ctl_new1() without checking the return value\nbefore dereferencing the pointer in multiple places (ice1712.c,\nice1724.c, aureon.c), which can lead to NULL pointer dereferences.\n\nAdd NULL checks after snd_ctl_new1() calls and return -ENOMEM if any\nfails."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:41.691Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57d59be545b309d4bb54ac472b15d1e67f254d95"
},
{
"url": "https://git.kernel.org/stable/c/69bf1dfa3215524c4ae255bb9dce0770875abbeb"
},
{
"url": "https://git.kernel.org/stable/c/d34ad480b8896d2b486e2cf29ce1790326cad205"
},
{
"url": "https://git.kernel.org/stable/c/71b87108ad93d433cdb20704a8dc8852304cf2c2"
},
{
"url": "https://git.kernel.org/stable/c/38a7cc46370a57122fb29c4bfe48a851c0c64459"
},
{
"url": "https://git.kernel.org/stable/c/2b929b91b0f3bc6de8a844370049cd99ee8e31ff"
}
],
"title": "ALSA: ice1712: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64480",
"datePublished": "2026-07-25T08:51:41.691Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-07-25T08:51:41.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64482 (GCVE-0-2026-64482)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: gus: check snd_ctl_new1() return value
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: gus: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_gf1_pcm_volume_control() does not check the return value before
dereferencing kctl->id.index, which can lead to a NULL pointer
dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c35034fd6446afaf408d5ab296068e32c775c965 , < 97f6bdf5d5ded2e37f358cacb5a95f1393356604
(git)
Affected: c5ae57b1bb99bd6f50b90428fabde397c2aeba0f , < eccf8e91266e39f6f15637702a04a1d344833fe2 (git) Affected: c5ae57b1bb99bd6f50b90428fabde397c2aeba0f , < fc5d4f27ca1293bc1379ef8fff691c30d9803ca2 (git) Affected: c5ae57b1bb99bd6f50b90428fabde397c2aeba0f , < 5e74e5e8cb7cc25f7a89f59abaf3489bf0c6f4a0 (git) Affected: c5ae57b1bb99bd6f50b90428fabde397c2aeba0f , < 465075c6835103821d725c13f8c545898e5f2636 (git) Affected: c5ae57b1bb99bd6f50b90428fabde397c2aeba0f , < c7fa99d30c7a166a5e5db5a585ce7501ff68326b (git) Affected: a1374d2683442633f8ad2169f8f31df45048e008 (git) Affected: 6.1.34 , < 6.1.178 (semver) Affected: 6.3.8 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/isa/gus/gus_pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "97f6bdf5d5ded2e37f358cacb5a95f1393356604",
"status": "affected",
"version": "c35034fd6446afaf408d5ab296068e32c775c965",
"versionType": "git"
},
{
"lessThan": "eccf8e91266e39f6f15637702a04a1d344833fe2",
"status": "affected",
"version": "c5ae57b1bb99bd6f50b90428fabde397c2aeba0f",
"versionType": "git"
},
{
"lessThan": "fc5d4f27ca1293bc1379ef8fff691c30d9803ca2",
"status": "affected",
"version": "c5ae57b1bb99bd6f50b90428fabde397c2aeba0f",
"versionType": "git"
},
{
"lessThan": "5e74e5e8cb7cc25f7a89f59abaf3489bf0c6f4a0",
"status": "affected",
"version": "c5ae57b1bb99bd6f50b90428fabde397c2aeba0f",
"versionType": "git"
},
{
"lessThan": "465075c6835103821d725c13f8c545898e5f2636",
"status": "affected",
"version": "c5ae57b1bb99bd6f50b90428fabde397c2aeba0f",
"versionType": "git"
},
{
"lessThan": "c7fa99d30c7a166a5e5db5a585ce7501ff68326b",
"status": "affected",
"version": "c5ae57b1bb99bd6f50b90428fabde397c2aeba0f",
"versionType": "git"
},
{
"status": "affected",
"version": "a1374d2683442633f8ad2169f8f31df45048e008",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.34",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/isa/gus/gus_pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: gus: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails.\nsnd_gf1_pcm_volume_control() does not check the return value before\ndereferencing kctl-\u003eid.index, which can lead to a NULL pointer\ndereference.\n\nAdd a NULL check after snd_ctl_new1() and return -ENOMEM if it fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:43.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/97f6bdf5d5ded2e37f358cacb5a95f1393356604"
},
{
"url": "https://git.kernel.org/stable/c/eccf8e91266e39f6f15637702a04a1d344833fe2"
},
{
"url": "https://git.kernel.org/stable/c/fc5d4f27ca1293bc1379ef8fff691c30d9803ca2"
},
{
"url": "https://git.kernel.org/stable/c/5e74e5e8cb7cc25f7a89f59abaf3489bf0c6f4a0"
},
{
"url": "https://git.kernel.org/stable/c/465075c6835103821d725c13f8c545898e5f2636"
},
{
"url": "https://git.kernel.org/stable/c/c7fa99d30c7a166a5e5db5a585ce7501ff68326b"
}
],
"title": "ALSA: gus: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64482",
"datePublished": "2026-07-25T08:51:43.128Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-07-25T08:51:43.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64483 (GCVE-0-2026-64483)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: firewire: isight: bound the sample count to the packet payload
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: firewire: isight: bound the sample count to the packet payload
isight_packet() takes the frame count from the device iso packet and
checks it only against the device claimed iso length.
count = be32_to_cpu(payload->sample_count);
if (likely(count <= (length - 16) / 4))
isight_samples(isight, payload->samples, count);
length is the iso header data_length. It can be up to 0xffff. So the
gate allows a count up to about 16379. isight_samples() then copies
count frames out of payload->samples into the PCM DMA buffer.
payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The
device multiplexes two samples per frame. A count past
MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer
size writes past runtime->dma_area. The smallest PCM buffer is larger
than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET
keeps both the read and the write in range.
A malicious or faulty Apple iSight on the FireWire bus reaches this
during a normal capture.
Add the MAX_FRAMES_PER_PACKET bound to the gate.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 24423e0a9251d348c3f1fb0bb0e61b879e1e976c
(git)
Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < ebbffacda6733dcbcef601b5b523460f8d8b671e (git) Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 57e4d9043afc1eaddee8f50d11def6e65415d273 (git) Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478 (git) Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 31da82b9676c6b112e7c72c7529e6812b919742a (git) Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 8e48a29813df8dd71503800b7acf69c12c035045 (git) Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 31a01b70bb90e3ef3147f308e2ea899e1d2485ca (git) Affected: 3a691b28a0ca3cf4d9010c6158318159e0275d2c , < 29b9667982e4df2ed7744f86b1144f8bb58eb698 (git) |
|
| Linux | Linux |
Affected:
3.0
Unaffected: 0 , < 3.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/firewire/isight.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24423e0a9251d348c3f1fb0bb0e61b879e1e976c",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "ebbffacda6733dcbcef601b5b523460f8d8b671e",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "57e4d9043afc1eaddee8f50d11def6e65415d273",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "31da82b9676c6b112e7c72c7529e6812b919742a",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "8e48a29813df8dd71503800b7acf69c12c035045",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "31a01b70bb90e3ef3147f308e2ea899e1d2485ca",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
},
{
"lessThan": "29b9667982e4df2ed7744f86b1144f8bb58eb698",
"status": "affected",
"version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/firewire/isight.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: firewire: isight: bound the sample count to the packet payload\n\nisight_packet() takes the frame count from the device iso packet and\nchecks it only against the device claimed iso length.\n\n\tcount = be32_to_cpu(payload-\u003esample_count);\n\tif (likely(count \u003c= (length - 16) / 4))\n\t\tisight_samples(isight, payload-\u003esamples, count);\n\nlength is the iso header data_length. It can be up to 0xffff. So the\ngate allows a count up to about 16379. isight_samples() then copies\ncount frames out of payload-\u003esamples into the PCM DMA buffer.\n\npayload-\u003esamples holds only 2 * MAX_FRAMES_PER_PACKET values. The\ndevice multiplexes two samples per frame. A count past\nMAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer\nsize writes past runtime-\u003edma_area. The smallest PCM buffer is larger\nthan MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET\nkeeps both the read and the write in range.\n\nA malicious or faulty Apple iSight on the FireWire bus reaches this\nduring a normal capture.\n\nAdd the MAX_FRAMES_PER_PACKET bound to the gate."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:43.851Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24423e0a9251d348c3f1fb0bb0e61b879e1e976c"
},
{
"url": "https://git.kernel.org/stable/c/ebbffacda6733dcbcef601b5b523460f8d8b671e"
},
{
"url": "https://git.kernel.org/stable/c/57e4d9043afc1eaddee8f50d11def6e65415d273"
},
{
"url": "https://git.kernel.org/stable/c/3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478"
},
{
"url": "https://git.kernel.org/stable/c/31da82b9676c6b112e7c72c7529e6812b919742a"
},
{
"url": "https://git.kernel.org/stable/c/8e48a29813df8dd71503800b7acf69c12c035045"
},
{
"url": "https://git.kernel.org/stable/c/31a01b70bb90e3ef3147f308e2ea899e1d2485ca"
},
{
"url": "https://git.kernel.org/stable/c/29b9667982e4df2ed7744f86b1144f8bb58eb698"
}
],
"title": "ALSA: firewire: isight: bound the sample count to the packet payload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64483",
"datePublished": "2026-07-25T08:51:43.851Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-07-25T08:51:43.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64484 (GCVE-0-2026-64484)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
ALSA: es1938: check snd_ctl_new1() return value
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: es1938: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_es1938_mixer() does not check the return value before dereferencing
the pointer, which can lead to a NULL pointer dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 96cad5bd7d0a176db3fdc06717a41271247336bd
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6c4efebaf73e217efbd08cdbda805758a7db3680 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 41759affbcfe3d51a32900da9547a1ffd744a85f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7531a37720c2545a480fd0fa464978569bf9d6a2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < af01c48e17a66fa038af210a5c49d6cdefd210bd (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9e53e99b6fa3cd82992d963cbff58dbbd1df8651 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1949163dee39e0e4a1468f37dd7302962f6af45a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1edd1f02dddd20aeb6066ded41017615766ea42f (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/es1938.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96cad5bd7d0a176db3fdc06717a41271247336bd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6c4efebaf73e217efbd08cdbda805758a7db3680",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "41759affbcfe3d51a32900da9547a1ffd744a85f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7531a37720c2545a480fd0fa464978569bf9d6a2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "af01c48e17a66fa038af210a5c49d6cdefd210bd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e53e99b6fa3cd82992d963cbff58dbbd1df8651",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1949163dee39e0e4a1468f37dd7302962f6af45a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1edd1f02dddd20aeb6066ded41017615766ea42f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/es1938.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: es1938: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails.\nsnd_es1938_mixer() does not check the return value before dereferencing\nthe pointer, which can lead to a NULL pointer dereference.\n\nAdd a NULL check after snd_ctl_new1() and return -ENOMEM if it fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:44.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96cad5bd7d0a176db3fdc06717a41271247336bd"
},
{
"url": "https://git.kernel.org/stable/c/6c4efebaf73e217efbd08cdbda805758a7db3680"
},
{
"url": "https://git.kernel.org/stable/c/41759affbcfe3d51a32900da9547a1ffd744a85f"
},
{
"url": "https://git.kernel.org/stable/c/7531a37720c2545a480fd0fa464978569bf9d6a2"
},
{
"url": "https://git.kernel.org/stable/c/af01c48e17a66fa038af210a5c49d6cdefd210bd"
},
{
"url": "https://git.kernel.org/stable/c/9e53e99b6fa3cd82992d963cbff58dbbd1df8651"
},
{
"url": "https://git.kernel.org/stable/c/1949163dee39e0e4a1468f37dd7302962f6af45a"
},
{
"url": "https://git.kernel.org/stable/c/1edd1f02dddd20aeb6066ded41017615766ea42f"
}
],
"title": "ALSA: es1938: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64484",
"datePublished": "2026-07-25T08:51:44.591Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-07-25T08:51:44.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…