{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "733cd8474e6d763d75ed96f3f2b98a25480cf2b9",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "4e2a96ec7236e248e706850568e0a925fd21b588",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "442ca20c54038e2400cf28aaa944cf1de2c8e65d",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "1ddf3fd21c4c652f9cab5552515c04a166662306",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "ff83de56882cb8466184d322abece2589258ca56",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "5d8a39649947a4e86c8fbc682d7fc0041b8d109a",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            },
            {
              "lessThan": "c4810ada31e80cbe4011467c4f3b1e93f94134f3",
              "status": "affected",
              "version": "af48b85b8cd3fbb12c9b6759c16db6d69c0b03da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate ACL entry sizes in f2fs_acl_from_disk()\n\nf2fs_acl_count() only validates the aggregate ACL xattr length. A\nmalformed ACL can still place ACL_USER or ACL_GROUP in a slot that only\ncontains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk()\nthen reads entry-\u003ee_id before verifying that a full entry fits.\n\nRequire a short entry before reading e_tag and e_perm, and require a\nfull entry before reading e_id for ACL_USER and ACL_GROUP. Return\n-EFSCORRUPTED from these new truncated-entry checks, while keeping the\npre-existing -EINVAL paths unchanged.\n\nValidation reproduced this kernel report:\nKASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0\nRIP: 0033:0x7f4b835ea7aa\nThe buggy address belongs to the object at ffff888114589960 which belongs\nto the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes to the right of allocated 8-byte\nregion [ffff888114589960, ffff888114589968)\nRead of size 4\nCall trace:\n  dump_stack_lvl+0x66/0xa0 (?:?)\n  print_report+0xce/0x630 (?:?)\n  __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169)\n  srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n  __virt_addr_valid+0x224/0x430 (?:?)\n  kasan_report+0xe0/0x110 (?:?)\n  __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169)\n  __get_acl+0x281/0x380 (?:?)\n  vfs_get_acl+0x10b/0x190 (?:?)\n  do_get_acl+0x2a/0x410 (?:?)\n  do_get_acl+0x9/0x410 (?:?)\n  do_getxattr+0xe8/0x260 (?:?)\n  filename_getxattr+0xd1/0x140 (?:?)\n  do_getname+0x2d/0x2d0 (?:?)\n  path_getxattrat+0x16c/0x200 (?:?)\n  lock_release+0xc8/0x290 (?:?)\n  cgroup_update_frozen+0x9d/0x320 (?:?)\n  lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?)\n  trace_hardirqs_on+0x1a/0x170 (?:?)\n  _raw_spin_unlock_irq+0x28/0x50 (?:?)\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local kernel entry points\u2014`getxattr`/`listxattr` syscalls (`path_getxattrat` \u2192 `do_getxattr` \u2192 `do_get_acl` \u2192 `vfs_get_acl` \u2192 `__get_acl` \u2192 `f2fs_get_acl` \u2192 `f2fs_acl_from_disk`), routine VFS permission checks (`check_acl` \u2192 `get_inode_acl`), and f2fs inode creation (`f2fs_init_acl` \u2192 `__f2fs_get_acl`). f2fs is overwhelmingly deployed as a local block filesystem (Android userdata, embedded flash); although nfsd/ksmbd also call `get_inode_acl`, that is a secondary path.\nAC:L - Once a malformed on-disk ACL xattr exists, triggering is deterministic\u2014the attacker fully controls the crafted ACL blob layout that passes `f2fs_acl_count()` but places `ACL_USER`/`ACL_GROUP` in a short-entry slot, causing a reliable 4-byte read past the allocated buffer. No races or victim-specific timing are required.\nPR:L - Normal `setxattr`/`setfacl` paths validate through `posix_acl_from_xattr` and write via `f2fs_acl_to_disk`, so planting the malformed on-disk format requires offline image crafting plus `CAP_SYS_ADMIN` (obtainable in an unprivileged user namespace) to loop-mount the image, or real root for raw block-device writes. Triggering only needs read access to the affected inode; `vfs_get_acl` performs no xattr permission check beyond LSM hooks.\nUI:N - In the highest-impact self-contained attack, the attacker crafts a malicious f2fs image and mounts it inside their own user namespace\u2014no victim interaction is required. A USB-delivery variant would need the victim to mount media, but that is not necessary for exploitation.\nS:U - The out-of-bounds read corrupts/leaks kernel heap memory within the same kernel security domain. This is a standard local kernel memory-safety flaw, not a cross-boundary escape (VM, container, or IOMMU).\nC:H - The vulnerability is a slab out-of-bounds read (`entry-\u003ee_id`, 4 bytes) past the kmalloc\u0027d ACL xattr buffer when a truncated `ACL_USER`/`ACL_GROUP` entry is parsed. This reads adjacent kernel heap objects and can disclose kernel pointers or other sensitive kernel data, satisfying the guidance for out-of-bounds kernel reads.\nI:H - Although the immediate fault is a read past bounds rather than a write, this is kernel heap memory corruption class behavior; adjacent-slab reads are routinely chained into further kernel exploitation (heap grooming, control of subsequent allocations) for arbitrary write and code execution. Per the scoring guidance to treat memory corruption bugs as enabling integrity compromise when uncertain, I:H is appropriate.\nA:H - The KASAN report confirms a slab-out-of-bounds access in `__f2fs_get_acl` during a syscall. The same path is hit on every permission-checked file access (`open`, `stat`, `exec`) and directory inode creation, so a malicious ACL on a widely accessed file can repeatedly fault the kernel or destabilize the system under memory hardening."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:00.414Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/733cd8474e6d763d75ed96f3f2b98a25480cf2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e2a96ec7236e248e706850568e0a925fd21b588"
        },
        {
          "url": "https://git.kernel.org/stable/c/442ca20c54038e2400cf28aaa944cf1de2c8e65d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ddf3fd21c4c652f9cab5552515c04a166662306"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff83de56882cb8466184d322abece2589258ca56"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d8a39649947a4e86c8fbc682d7fc0041b8d109a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4810ada31e80cbe4011467c4f3b1e93f94134f3"
        }
      ],
      "title": "f2fs: validate ACL entry sizes in f2fs_acl_from_disk()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63814",
    "datePublished": "2026-07-19T12:02:14.771Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:00.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c8d6b4093aea40a20596f452289e7c22d84e6d5",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "a08ee30dcbeff6b97df75c38c2589603ddde53a6",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "c3e05522daae4e7348a1ea81eeb321d25aa0fd3b",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "76e1a05cf6d4051931d7fa4ead51a05786a62918",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "16bc237ce3c483b75575abea53cfb639745311ed",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            },
            {
              "lessThan": "378acf3cf19b6af6cba55e8dd1154c4e1504bae8",
              "status": "affected",
              "version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size = le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set.  An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA()  = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page()   = CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue.  The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size == 0 are still accepted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (mount on a block/loop device, then getdents/lookup on an inline directory); f2fs is not reachable via a network-facing in-kernel protocol handler.\nAC:L - The attacker fully controls the on-disk inode fields in a crafted f2fs image and can reliably trigger the bug by mounting that image and reading the directory; no race or rare runtime state is required.\nPR:N - An attacker can craft a malicious f2fs image offline with no privileges on the target system; exploitation is triggered when the image is mounted and its inline directory is read, including by privileged auto-mount services on shared/kiosk systems.\nUI:N - No victim user action beyond the attacker\u0027s own mount and directory read is required; an attacker with user-namespace mount capability can self-trigger without involving another user.\nS:U - Impact is kernel memory corruption and information disclosure within the same kernel security boundary, not a cross-boundary escape such as guest-to-host VM breakout.\nC:H - The corrupted geometry drives out-of-bounds reads via test_bit_le(), dentry, and filename pointer accesses far beyond the inline data area, enabling kernel memory disclosure.\nI:H - Integer underflow in inode geometry also corrupts ADDRS_PER_INODE/addrs_per_page calculations for regular files, creating memory corruption that can be leveraged for out-of-bounds writes and further exploitation.\nA:H - Reading far past the inline area can cause kernel oops or panic, and the corrupted address calculations can crash or destabilize the kernel during subsequent file operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:01.489Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d"
        },
        {
          "url": "https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8"
        }
      ],
      "title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63815",
    "datePublished": "2026-07-19T12:02:15.345Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:01.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/checkpoint.c",
            "include/linux/f2fs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "210c210c92d78fdf5051bc55c5c69044b1a2150a",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "ad101d15716f5a24d1fa82a849f80430c805a3dd",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "d2f236196d542ccd8505736e41c3a1d3f0305f6f",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "550511a2470f6d204fa07b331f048bd2d3c51280",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "8aad54746c251f2c2370118df766c0c82e2d2091",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "2e12381d4495dc8b0ff042c6856022b2e359835c",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            },
            {
              "lessThan": "846c499a65816d13f1186e3090e825e8bb8bcb8b",
              "status": "affected",
              "version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/checkpoint.c",
            "include/linux/f2fs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate orphan inode entry count\n\nf2fs_recover_orphan_inodes() trusts the orphan block entry_count when\nreplaying orphan inodes from the checkpoint pack. A corrupted entry_count\nlarger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the\nino[] array and interpret footer or following data as inode numbers.\n\nOn a crafted image, mounting an unpatched kernel can drive orphan recovery\ninto f2fs_bug_on() and panic the kernel. Validate entry_count before\nconsuming entries so corrupted checkpoint data fails the mount with\n-EFSCORRUPTED and requests fsck instead.\n\nSet ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be\nrecorded in the superblock s_errors[] field. This gives fsck a persistent\nhint even though mount-time orphan recovery failure may leave no chance to\npersist SBI_NEED_FSCK through a checkpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code runs only during F2FS mount via the mount syscall path (fs_context \u2192 get_tree_bdev \u2192 f2fs_fill_super \u2192 f2fs_recover_orphan_inodes); it is not reachable from network protocols or device drivers.\nAC:L - An attacker fully controls the crafted on-disk orphan block including entry_count and ino[] contents, so triggering the bug is reliable once a victim or privileged auto-mount path mounts the image; no race or rare layout dependency is required.\nPR:N - The attacker needs no privileges on the victim system\u2014only a malicious F2FS image delivered via removable media, downloaded disk image, or similar that a privileged mount/auto-mount daemon later processes.\nUI:N - No victim interaction is required when the attacker mounts their own crafted image (e.g., loop mount in a user namespace with CAP_SYS_ADMIN), and automated privileged mount paths can process attacker-supplied media without further user action.\nS:U - Impact is confined to kernel/filesystem integrity and availability on the host mounting the image; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The unchecked loop indexes past ino[F2FS_ORPHANS_PER_BLOCK-1] into the block footer and beyond the 4 KiB orphan block, constituting an out-of-bounds read of attacker-influenced metadata that can leak kernel-adjacent memory contents.\nI:H - Misinterpreted inode numbers are passed to recover_orphan_inode(), which clear_nlink() and iput() (truncating data) on matching real inodes, enabling deliberate destruction of filesystem contents from a crafted image.\nA:H - Crafted entry_count values drive f2fs_bug_on() on -ENOENT (kernel BUG/panic with CONFIG_F2FS_CHECK_FS, or WARN/oops otherwise) and can hang or crash the system during mount via unbounded orphan recovery iteration."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:04.694Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c"
        },
        {
          "url": "https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b"
        }
      ],
      "title": "f2fs: validate orphan inode entry count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63818",
    "datePublished": "2026-07-19T12:02:17.022Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:04.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e569a5cb401a267168621aa9a1e7f07fcc9612c3",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "0aa097a370277deab5337030b9e2d395742f469c",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "0a946abb82f29abe9a15173b707a449cb039b43e",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "318703b6f71d1a29ee0ac46c32a38f7734d4cfb2",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "051f954b94479d72222c9fbc82a3eef4777bca01",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "8b7a26b6681922a38cd5a7829ace61f8e54df9b7",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix warning when unbinding\n\nIf there is an error during some initialization related to firmware,\nthe buffers dp-\u003etx_ring[i].tx_status are released.\nHowever this is released again when the device is unbinded (ath11k_pci),\nand we get:\nWARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90\nCall Trace:\nfree_large_kmalloc\nath11k_dp_free\nath11k_core_deinit\nath11k_pci_remove\n...\n\nThe issue is always reproducible from a VM because the MSI addressing\ninitialization is failing.\n\nIn order to fix the issue, just set the buffers to NULL after releasing in\norder to avoid the double free."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T12:02:19.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e569a5cb401a267168621aa9a1e7f07fcc9612c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa097a370277deab5337030b9e2d395742f469c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a946abb82f29abe9a15173b707a449cb039b43e"
        },
        {
          "url": "https://git.kernel.org/stable/c/318703b6f71d1a29ee0ac46c32a38f7734d4cfb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13"
        },
        {
          "url": "https://git.kernel.org/stable/c/40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/051f954b94479d72222c9fbc82a3eef4777bca01"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b7a26b6681922a38cd5a7829ace61f8e54df9b7"
        }
      ],
      "title": "wifi: ath11k: fix warning when unbinding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63822",
    "datePublished": "2026-07-19T12:02:19.286Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-07-19T12:02:19.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/keys/request_key_auth-type.h",
            "security/keys/internal.h",
            "security/keys/keyctl.c",
            "security/keys/request_key_auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d8274181b0f28d450b42489723a5ba81042158d7",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "4982bfabce6b33b3c9eddb4fb900fe5568b7cf91",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "708709c65a1832a99b0eef8ae46e343ddaca3d06",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "35ab4db86774d82389e4b9559e26ab7f68d8e395",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "f9b68632ac93cc742f2e411021c4dbfe452ea0c2",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "7216ce8cb12fee44e309503955bb83806b106129",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29f",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            },
            {
              "lessThan": "fd15b457a86939c38aa12116adabd8ff686c5e51",
              "status": "affected",
              "version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/keys/request_key_auth-type.h",
            "security/keys/internal.h",
            "security/keys/keyctl.c",
            "security/keys/request_key_auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Pin request_key_auth payload in instantiate paths\n\nA: request_key()       B: KEYCTL_INSTANTIATE_IOV\n================       =========================\n\ncreate auth key\nstore rka in auth key\nwait for helper\n                       get auth key\n                       load rka from auth key\n                       copy user payload\n                       sleep on #PF\n\nhelper completed\ndetach and free rka\ndestroy auth key\n                       wake up\n                       use rka-\u003etarget_key\n                       **USE-AFTER-FREE**\n\nGive request_key_auth payloads a refcount.  Take a payload reference while\nauthkey-\u003esem stabilizes the payload and revocation state.  Hold that\nreference across the instantiate and reject paths.  Drop the auth key\nowning reference from revoke and destroy.\n\n[jarkko: Replaced the first two paragraphs of text with an actual\n concurrency scenario.]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker\u2019s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka-\u003etarget_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:06.856Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d8274181b0f28d450b42489723a5ba81042158d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4982bfabce6b33b3c9eddb4fb900fe5568b7cf91"
        },
        {
          "url": "https://git.kernel.org/stable/c/708709c65a1832a99b0eef8ae46e343ddaca3d06"
        },
        {
          "url": "https://git.kernel.org/stable/c/35ab4db86774d82389e4b9559e26ab7f68d8e395"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9b68632ac93cc742f2e411021c4dbfe452ea0c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7216ce8cb12fee44e309503955bb83806b106129"
        },
        {
          "url": "https://git.kernel.org/stable/c/83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd15b457a86939c38aa12116adabd8ff686c5e51"
        }
      ],
      "title": "keys: Pin request_key_auth payload in instantiate paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63823",
    "datePublished": "2026-07-19T12:02:19.847Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:06.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/keyctl_pkey.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "622ec2dcd59f21623f2a7ab773c80ceb7d555e3a",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "b1e247338bc71826a2d2def3e0874c34749df69a",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "5966e4e2ba213ab7ad559166152eb4f1f170dd2c",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "5165f1cc727f1322456735df212d8e26ec237a8d",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "b11c1fa32667692a2c0566e10163758e786e430c",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "670fc6a311ed321522b7fff92cf0fc376b4f6e78",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            },
            {
              "lessThan": "cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b",
              "status": "affected",
              "version": "00d60fd3b93219ea854220f0fd264b86398cbc53",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/keyctl_pkey.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:07.930Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c"
        },
        {
          "url": "https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b"
        }
      ],
      "title": "KEYS: fix overflow in keyctl_pkey_params_get_2()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63824",
    "datePublished": "2026-07-19T12:02:20.406Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:07.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "643221da57dbb1a8fd800610331cf1ec27969f71",
              "status": "affected",
              "version": "3b8e77c7abab40e6de9ad9de730d77984a498840",
              "versionType": "git"
            },
            {
              "lessThan": "b17f0c59cc1525765625cf07d0391b7f9c1ed7e5",
              "status": "affected",
              "version": "d9d8560b9b7932f8cffc4c068c14289220900f79",
              "versionType": "git"
            },
            {
              "lessThan": "a7a2890028f16e5b0af0bb005d80fcb32559cca3",
              "status": "affected",
              "version": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
              "versionType": "git"
            },
            {
              "lessThan": "15fd83a1e42ede15070968806bb6c8b1a5170688",
              "status": "affected",
              "version": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
              "versionType": "git"
            },
            {
              "lessThan": "ce261a20b41db522e320a41bbf1292bf85af66df",
              "status": "affected",
              "version": "f9761add6d100962a23996cb68f3d6abdd4d1815",
              "versionType": "git"
            },
            {
              "lessThan": "c3ca2631073b2cef06824fd2bfc452ff7a1023de",
              "status": "affected",
              "version": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
              "versionType": "git"
            },
            {
              "lessThan": "5e34fa9f6f7cd688ae153fff13139a5cf2d42339",
              "status": "affected",
              "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "versionType": "git"
            },
            {
              "lessThan": "6f060496d03e4dc560a40f73770bd08335cb7a27",
              "status": "affected",
              "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "763e838adc3c7ec5a7df2990ce84cad951e42721",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.177",
              "status": "affected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.144",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.95",
              "status": "affected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.38",
              "status": "affected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "6.1.169",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.12.77",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix use-after-free in rawdata dedup loop\n\naa_replace_profiles() walks ns-\u003erawdata_list to dedup the incoming\npolicy blob against entries already attached to existing profiles.\nPer the kernel-doc on struct aa_loaddata, list membership does not\nhold a reference: profiles hold pcount, and when the last pcount\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes\nns-\u003elock and removes the entry. Between dropping the last pcount\nand the workqueue running, an entry remains on the list with\npcount == 0.\n\naa_get_profile_loaddata() is an unconditional kref_get() on\npcount, so when the dedup loop hits such an entry, refcount\nhardening reports\n\n  refcount_t: addition on 0; use-after-free.\n\ninside aa_replace_profiles(), and the poisoned counter then\ntrips \"saturated\" and \"underflow\" warnings on the subsequent\nuses of the same loaddata.\n\nBefore commit a0b7091c4de4 (\"apparmor: fix race on rawdata\ndereference\") the dedup path used a get_unless_zero-style helper\non a single counter, so the existing \"if (tmp)\" guard was\nmeaningful. The split-refcount refactor introduced\naa_get_profile_loaddata(), which has plain kref_get() semantics,\nand the guard quietly became a no-op.\n\nIntroduce aa_get_profile_loaddata_not0(), matching the existing\n_not0 convention used by aa_get_profile_not0(), and use it for\nthe rawdata_list dedup lookup so dying entries are skipped.\n\nReproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu\n24.04 + stress-ng 0.17.06:\n\n  stress-ng --apparmor 1 --klog-check --timeout 60s\n\nWithout this patch the three refcount_t warnings fire within a\nfew seconds. With it the same 60 s run is clean. Coverage is a\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the\ncycles."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local write() to AppArmor policy management interfaces (.load/.replace) under securityfs/apparmorfs, not through any network-facing protocol.\nAC:L - An attacker with policy-admin capability can reliably win the race by concurrently loading/replacing and removing profiles with identical rawdata blobs, as demonstrated by stress-ng reproducing refcount UAF warnings within seconds.\nPR:L - Triggering aa_replace_profiles() requires CAP_MAC_ADMIN plus policy-view rights; on typical AppArmor deployments (e.g. Ubuntu) namespace-root in an unprivileged user namespace can obtain CAP_MAC_ADMIN via unprivileged_userns_apparmor_policy without init-namespace root.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own policy load/replace/remove operations and does not require any action from another user or administrator.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security boundary, not a cross-VM or cross-security-authority escape.\nC:H - The vulnerability is a use-after-free on aa_loaddata profile refcounts; refcount hardening reports \"addition on 0; use-after-free\" and poisons the counter, creating a path to arbitrary kernel memory disclosure.\nI:H - UAF and refcount saturation/underflow on aa_loaddata enable heap corruption primitives that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - The bug reliably triggers refcount_t UAF warnings and corrupts subsequent refcount operations on the same loaddata, causing kernel instability and potential crash/panic under concurrent policy management."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:10.099Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71"
        },
        {
          "url": "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3"
        },
        {
          "url": "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27"
        }
      ],
      "title": "apparmor: fix use-after-free in rawdata dedup loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63827",
    "datePublished": "2026-07-19T12:02:22.083Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:10.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a16714e7cf2baa98ba2efddd5d6cbac641f4e76b",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "20383429b56974507c465d016e5238b189f7a246",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "7f57428ce00891d26b0f087ef754a4d820ec83aa",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "faea60deaa05c76f0772650f42eafde12bd39d93",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "07b71c342382b854ab8030b244aeab6a7228ad7d",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "4a69b83045d3195d5b9a9b053ad840ddb2998b4e",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "45ebb934ea50b436ce49b2f159f090dab0d7fa28",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            },
            {
              "lessThan": "4d587cd8a72155089a627130bbd4716ec0856e21",
              "status": "affected",
              "version": "cf60af03ca4e71134206809ea892e49b92a88896",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: mediate the implicit connect of TCP fast open sendmsg\n\nsendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and\nwrite(2): it opens the connection in the SYN. apparmor_socket_sendmsg()\nonly checks AA_MAY_SEND, so a profile that grants send but denies connect\nlets a confined task open an outbound TCP/MPTCP connection that connect(2)\nwould have refused, bypassing connect mediation.\n\nMediate the implicit connect when MSG_FASTOPEN is set and a destination\nis supplied. Add it to apparmor_socket_sendmsg() (not the shared\naa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()\ndirectly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not\ncover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a confined local process to invoke sendmsg(2)/sendto(2) with MSG_FASTOPEN; the vulnerable AppArmor LSM hook runs on the syscall path before TCP fast-open performs its implicit connect.\nAC:L - Any confined task that already has send permission can reliably trigger the bypass with a single sendmsg/sendto call using MSG_FASTOPEN and a destination address, with no race or special victim state required beyond TCP Fast Open client support.\nPR:L - The attacker must be an unprivileged process confined by an AppArmor profile that grants network send but denies connect (e.g., hardened Snap/sandboxed service profiles on Ubuntu); no real root or capabilities beyond normal confined-user execution are needed.\nUI:N - No victim interaction is required; the confined attacker process directly issues the bypassing syscall without needing another user or administrator to perform any action.\nS:C - Successful exploitation crosses the AppArmor confinement boundary, allowing a sandboxed task to establish outbound TCP/MPTCP connections that connect(2) mediation would have blocked, escaping the intended network policy scope.\nC:H - Bypassing connect mediation lets a confined process open TCP/MPTCP sessions to destinations policy forbids and read arbitrary response data from those services (internal APIs, metadata endpoints, C2 servers), constituting unauthorized information disclosure.\nI:H - The bypass enables unauthorized outbound connection establishment and transmission of arbitrary application data (including SYN-cookie data) to hosts explicitly denied by the AppArmor connect rule, violating integrity of the confinement policy.\nA:N - This is a pure LSM policy-bypass flaw with no kernel memory corruption, panic, oops, hang, or resource exhaustion; exploitation does not impact system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:11.164Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a16714e7cf2baa98ba2efddd5d6cbac641f4e76b"
        },
        {
          "url": "https://git.kernel.org/stable/c/20383429b56974507c465d016e5238b189f7a246"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93"
        },
        {
          "url": "https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21"
        }
      ],
      "title": "apparmor: mediate the implicit connect of TCP fast open sendmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63828",
    "datePublished": "2026-07-19T12:02:22.644Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:11.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/rtnetlink.h",
            "net/core/rtnetlink.c",
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19275943d8fe903eb7b9aa53e380e41efd042ada",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "866b0f5ae599490bd496fd84581c68ac8b94e6af",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "92b766fc55156e0da2ecd0c2302c971118f8a229",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "e54c05ed3d9c28733fb9e5837219aca3691defa3",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "9831bc9ecb402957810c2045c663fbfe9b09e296",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "1697957eb0971d420dde42862b88eb43506a1105",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "47b5d3d506609b08b2e1f7c14f0b681a1953d572",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "8165f7ff57d9667d2bb477ef6af83ede7fed4ad7",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/rtnetlink.h",
            "net/core/rtnetlink.c",
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t-\u003enet. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t-\u003ecollect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller\u0027s netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t-\u003enet while authorization is checked only against dev_net(dev), crossing from the attacker\u0027s net/user namespace into another tenant\u0027s or the host\u0027s network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:12.246Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af"
        },
        {
          "url": "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229"
        },
        {
          "url": "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296"
        },
        {
          "url": "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572"
        },
        {
          "url": "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7"
        }
      ],
      "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63829",
    "datePublished": "2026-07-19T12:02:23.191Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:12.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skmsg.h",
            "net/core/filter.c",
            "net/core/skmsg.c",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f126eed589eec6f201405abbc398844042ef6d57",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "31a110642b5fb5e61940cbcfb503445ac4f28017",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "9bb86d8184b37503816150c4a6ad3c17dfdbe827",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "0eb4c16c4adb262763bda870a8ed38a1a9dec7ec",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "d22cc92bc41290e5783a72375e0843d9435f6001",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "1acdd14c0990dd1cd4b6534f00366d2e6dfce05f",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "406e8a651a7b854c41fecd5117bb282b3a6c2c6b",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skmsg.h",
            "net/core/filter.c",
            "net/core/skmsg.c",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skmsg: preserve sg.copy across SG transforms\n\nThe sk_msg sg.copy bitmap is part of the scatterlist entry ownership\nstate. A set bit tells sk_msg_compute_data_pointers() not to expose the\nentry through writable BPF ctx-\u003edata. This protects entries backed by\npages that are not private to the sk_msg, such as splice-backed file\npage-cache pages.\n\nSeveral sk_msg transform paths move, copy, split, or compact\nmsg-\u003esg.data[] entries without moving the matching sg.copy bit. This can\nmake an externally backed entry arrive at a new slot with a clear copy\nbit. A later SK_MSG verdict can then expose sg_virt(sge) as writable\nctx-\u003edata and BPF stores can modify the original page cache.\n\nKeep sg.copy synchronized with sg.data[] whenever entries are\ntransferred, shifted, split, or copied into a new sk_msg. Clear the bit\nwhen an entry is replaced by a newly allocated private page or freed.\nThis covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(),\nsk_msg_xfer(), and tls_split_open_record(), including the partial tail\nentry created during TLS open-record splitting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is exercised on the kTLS/TCP send path when splice-backed page-cache pages in an sk_msg are processed by an SK_MSG BPF verdict on network sockets; a remote TLS peer can trigger this on internet-facing servers (HTTPS, service-mesh edge nodes) that serve file-backed responses via splice/sendfile.\nAC:L - The attacker controls the traffic patterns, message sizes, and splice-backed data needed to hit the desynchronized transform paths (bpf_msg_push/pop/pull, sk_msg shift/xfer, tls_split_open_record); no race against unrelated system state is required.\nPR:N - On production kTLS servers with an attached SK_MSG BPF program (common in Cilium/Cloudflare-class deployments), an unauthenticated remote peer can trigger the faulty transforms without any credentials on the victim; a fully local exploit via user-namespace CAP_NET_ADMIN is also possible but is not the highest-severity case.\nUI:N - Exploitation requires only network traffic to a vulnerable server (or local socket I/O); no victim user action such as opening a file or mounting a filesystem is needed beyond normal server operation.\nS:U - Impact remains within the kernel\u0027s security authority (page-cache corruption via the network/BPF stack); it does not cross a VM-hypervisor or IOMMU boundary even though corrupted cache pages may affect other processes.\nC:H - Exposing splice-backed page-cache pages as writable BPF ctx-\u003edata gives the attacker a kernel memory write primitive over shared file cache pages, which can be leveraged to read or infer sensitive file contents served from or mapped through the corrupted pages.\nI:H - The commit explicitly states BPF stores through the incorrectly writable ctx-\u003edata can modify the original page cache, constituting arbitrary integrity corruption of file-backed data beyond the socket buffer.\nA:L - While the primary impact is data corruption rather than a kernel oops, corrupting shared page-cache pages of files actively served to other clients can cause sustained service disruption and repeated application-level failures; when uncertain, availability impact above None is appropriate."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:13.332Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f126eed589eec6f201405abbc398844042ef6d57"
        },
        {
          "url": "https://git.kernel.org/stable/c/31a110642b5fb5e61940cbcfb503445ac4f28017"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bb86d8184b37503816150c4a6ad3c17dfdbe827"
        },
        {
          "url": "https://git.kernel.org/stable/c/0eb4c16c4adb262763bda870a8ed38a1a9dec7ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/d22cc92bc41290e5783a72375e0843d9435f6001"
        },
        {
          "url": "https://git.kernel.org/stable/c/1acdd14c0990dd1cd4b6534f00366d2e6dfce05f"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/406e8a651a7b854c41fecd5117bb282b3a6c2c6b"
        }
      ],
      "title": "net: skmsg: preserve sg.copy across SG transforms",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63830",
    "datePublished": "2026-07-19T12:02:23.741Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-05T12:36:13.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}