{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_accept.c",
            "net/rxrpc/peer_object.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d94b82d452ca27a200cd67660dc48476386651d8",
              "status": "affected",
              "version": "77433b730970ca6e51d03016e830d8ab1b22685a",
              "versionType": "git"
            },
            {
              "lessThan": "8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36",
              "status": "affected",
              "version": "09c59a82298f424f6212c67fbea531853e88ce6c",
              "versionType": "git"
            },
            {
              "lessThan": "2029f21f10dedb88c0f86abffcf8d6c21dcf6040",
              "status": "affected",
              "version": "a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7",
              "versionType": "git"
            },
            {
              "lessThan": "e4d2878369d590bf8455e3678a644e503172eafa",
              "status": "affected",
              "version": "a2ea9a9072607c2fd6442bd1ffb4dbdbf882aed7",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.101",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/call_accept.c",
            "net/rxrpc/peer_object.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix irq-disabled in local_bh_enable()\n\nThe rxrpc_assess_MTU_size() function calls down into the IP layer to find\nout the MTU size for a route.  When accepting an incoming call, this is\ncalled from rxrpc_new_incoming_call() which holds interrupts disabled\nacross the code that calls down to it.  Unfortunately, the IP layer uses\nlocal_bh_enable() which, config dependent, throws a warning if IRQs are\nenabled:\n\nWARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0\n...\nRIP: 0010:__local_bh_enable_ip+0x43/0xd0\n...\nCall Trace:\n \u003cTASK\u003e\n rt_cache_route+0x7e/0xa0\n rt_set_nexthop.isra.0+0x3b3/0x3f0\n __mkroute_output+0x43a/0x460\n ip_route_output_key_hash+0xf7/0x140\n ip_route_output_flow+0x1b/0x90\n rxrpc_assess_MTU_size.isra.0+0x2a0/0x590\n rxrpc_new_incoming_peer+0x46/0x120\n rxrpc_alloc_incoming_call+0x1b1/0x400\n rxrpc_new_incoming_call+0x1da/0x5e0\n rxrpc_input_packet+0x827/0x900\n rxrpc_io_thread+0x403/0xb60\n kthread+0x2f7/0x310\n ret_from_fork+0x2a/0x230\n ret_from_fork_asm+0x1a/0x30\n...\nhardirqs last  enabled at (23): _raw_spin_unlock_irq+0x24/0x50\nhardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70\nsoftirqs last  enabled at (0): copy_process+0xc61/0x2730\nsoftirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90\n\nFix this by moving the call to rxrpc_assess_MTU_size() out of\nrxrpc_init_peer() and further up the stack where it can be done without\ninterrupts disabled.\n\nIt shouldn\u0027t be a problem for rxrpc_new_incoming_call() to do it after the\nlocks are dropped as pmtud is going to be performed by the I/O thread - and\nwe\u0027re in the I/O thread at this point."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is entered directly from `rxrpc_encap_rcv()`/`rxrpc_input_packet()` when an rxrpc DATA packet arrives over UDP from an unknown peer, and kAFS binds its callback-manager service socket to `in6addr_any:7001`, so any routable remote host can reach it.\nAC:L - The attacker fully controls every precondition \u2014 a single crafted rxrpc DATA packet (`callNumber != 0`, `seq == 1`, matching serviceId) from a source port not yet in the peer hash deterministically forces new-peer creation and the MTU assessment under `read_lock_irq()`; no memory layout, timing, or victim state is involved.\nPR:N - `rxrpc_new_incoming_call()` runs entirely before any rxrpc authentication \u2014 the CHALLENGE/RESPONSE handshake is only queued after the call is made live, and `rxrpc_get_incoming_security()` merely validates that the security index is supported, so an unauthenticated off-path attacker suffices.\nUI:N - The AFS/rxrpc service socket is already bound and listening as soon as AFS is in use; processing of the attacker\u0027s packet happens autonomously in the rxrpc I/O kernel thread with no victim action.\nS:U - The fault and its effects are confined to the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is purely a locking/IRQ-context violation with no out-of-bounds read, use-after-free, or uninitialised data exposure; nothing is leaked to the remote attacker, who cannot observe the kernel log.\nI:N - No memory is corrupted and no attacker-controlled data is written out of bounds \u2014 the peer backlog ring update completes before the offending call, so there is no write primitive or state modification available.\nA:H - `lockdep_assert_irqs_enabled()` WARNs on `CONFIG_PROVE_LOCKING` kernels, which is a hard panic under the widely deployed `panic_on_warn=1`; independently of that config, `do_softirq()`/`handle_softirqs()` re-enables hardirqs and burns up to 2 ms \u00d7 10 restarts of softirq work inside the `read_lock_irq()` + `spin_lock()` section, stalling the rxrpc I/O thread \u2014 and the whole sequence is remotely repeatable at packet rate by rotating source ports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T12:10:47.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d94b82d452ca27a200cd67660dc48476386651d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ac0b3baa7d8f732bd9e5cbf1d8b57e4802c6b36"
        },
        {
          "url": "https://git.kernel.org/stable/c/2029f21f10dedb88c0f86abffcf8d6c21dcf6040"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4d2878369d590bf8455e3678a644e503172eafa"
        }
      ],
      "title": "rxrpc: Fix irq-disabled in local_bh_enable()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38525",
    "datePublished": "2025-08-16T11:12:19.191Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-08-10T12:10:47.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f7b44b4a2b2939f08b279cbb9e6b5dcb8ffea32",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            },
            {
              "lessThan": "e193d8953647c8b575830852aa5ea0995b98d2b1",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            },
            {
              "lessThan": "410337c2301ae78a081e1b5ebbe8ec374fef4cb6",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            },
            {
              "lessThan": "68e094232dfe5027c4fd2dcded93d2d6800bae04",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            },
            {
              "lessThan": "7dd611131d82d7fc4212b555eb1103160bdad302",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            },
            {
              "lessThan": "01118321e0c8a5f3ece57d0d377bfc92d83cd210",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            },
            {
              "lessThan": "edf7e9040fc52c922db947f9c6c36f07377c52ea",
              "status": "affected",
              "version": "0b20fcec8651569935a10afe03fedc0b812d044e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix UAF issue in f2fs_merge_page_bio()\n\nAs JY reported in bugzilla [1],\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000000\npc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98\nlr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4\nCPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P    B   W  OE      6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5\nTainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nWorkqueue: writeback wb_workfn (flush-254:49)\nCall trace:\n f2fs_is_cp_guaranteed+0x70/0x98\n f2fs_inplace_write_data+0x174/0x2f4\n f2fs_do_write_data_page+0x214/0x81c\n f2fs_write_single_data_page+0x28c/0x764\n f2fs_write_data_pages+0x78c/0xce4\n do_writepages+0xe8/0x2fc\n __writeback_single_inode+0x4c/0x4b4\n writeback_sb_inodes+0x314/0x540\n __writeback_inodes_wb+0xa4/0xf4\n wb_writeback+0x160/0x448\n wb_workfn+0x2f0/0x5dc\n process_scheduled_works+0x1c8/0x458\n worker_thread+0x334/0x3f0\n kthread+0x118/0x1ac\n ret_from_fork+0x10/0x20\n\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575\n\nThe panic was caused by UAF issue w/ below race condition:\n\nkworker\n- writepages\n - f2fs_write_cache_pages\n  - f2fs_write_single_data_page\n   - f2fs_do_write_data_page\n    - f2fs_inplace_write_data\n     - f2fs_merge_page_bio\n      - add_inu_page\n      : cache page #1 into bio \u0026 cache bio in\n        io-\u003ebio_list\n  - f2fs_write_single_data_page\n   - f2fs_do_write_data_page\n    - f2fs_inplace_write_data\n     - f2fs_merge_page_bio\n      - add_inu_page\n      : cache page #2 into bio which is linked\n        in io-\u003ebio_list\n\t\t\t\t\t\twrite\n\t\t\t\t\t\t- f2fs_write_begin\n\t\t\t\t\t\t: write page #1\n\t\t\t\t\t\t - f2fs_folio_wait_writeback\n\t\t\t\t\t\t  - f2fs_submit_merged_ipu_write\n\t\t\t\t\t\t   - f2fs_submit_write_bio\n\t\t\t\t\t\t   : submit bio which inclues page #1 and #2\n\n\t\t\t\t\t\tsoftware IRQ\n\t\t\t\t\t\t- f2fs_write_end_io\n\t\t\t\t\t\t - fscrypt_free_bounce_page\n\t\t\t\t\t\t : freed bounced page which belongs to page #2\n      - inc_page_count( , WB_DATA_TYPE(data_folio), false)\n      : data_folio points to fio-\u003eencrypted_page\n        the bounced page can be freed before\n        accessing it in f2fs_is_cp_guarantee()\n\nIt can reproduce w/ below testcase:\nRun below script in shell #1:\nfor ((i=1;i\u003e0;i++)) do xfs_io -f /mnt/f2fs/enc/file \\\n-c \"pwrite 0 32k\" -c \"fdatasync\"\n\nRun below script in shell #2:\nfor ((i=1;i\u003e0;i++)) do xfs_io -f /mnt/f2fs/enc/file \\\n-c \"pwrite 0 32k\" -c \"fdatasync\"\n\nSo, in f2fs_merge_page_bio(), let\u0027s avoid using fio-\u003eencrypted_page after\ncommit page into internal ipu cache."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through ordinary local filesystem syscalls (write/pwrite plus fdatasync) on a mounted f2fs volume, driving the writeback kworker into f2fs_merge_page_bio(); no network or remote peer data is involved.\nAC:L - The attacker controls both sides of the race \u2014 one thread\u0027s writeback caches the encrypted bounce page in the IPU bio list while a second thread\u0027s f2fs_write_begin \u2192 f2fs_folio_wait_writeback submits that same bio and frees the bounce page \u2014 and the commit supplies a trivial two-shell reproducer loop, so it can be hit reliably by repetition.\nPR:L - Only an unprivileged local user with write access to a file in an fscrypt-encrypted directory on f2fs is needed; this is the default state for every app on Android/ChromeOS f2fs /data, and elsewhere any user can set a v2 encryption policy on their own directory without CAP_SYS_ADMIN.\nUI:N - No victim action is required \u2014 the attacker\u0027s own two processes perform all writes and syncs against an already-mounted filesystem, and the racing writeback kworker runs automatically.\nS:U - The freed object, the corrupted accounting counters and the faulting code all live within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a freed fscrypt bounce-page descriptor whose contents are reused by whatever next owns that page, and the stale pointer read from it is dereferenced, giving an attacker-influenceable wild read of kernel memory that leaks into observable filesystem accounting state.\nI:H - Use-after-free of a mempool page that can be recycled into arbitrary kernel allocations makes heap grooming and control over the dereferenced pointer feasible, and the garbage value directly corrupts persistent sbi-\u003enr_pages writeback accounting, wedging checkpoint state machine decisions such as f2fs_stop_checkpoint.\nA:H - The bug is confirmed in the wild to panic the kernel with a NULL pointer dereference in f2fs_is_cp_guaranteed() from the writeback kworker, and a mismatched WB_DATA_TYPE increment leaves F2FS_WB_CP_DATA permanently non-zero, hanging f2fs_wait_on_all_pages() in an uninterruptible loop so sync/umount never complete."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:24.871Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f7b44b4a2b2939f08b279cbb9e6b5dcb8ffea32"
        },
        {
          "url": "https://git.kernel.org/stable/c/e193d8953647c8b575830852aa5ea0995b98d2b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/410337c2301ae78a081e1b5ebbe8ec374fef4cb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/68e094232dfe5027c4fd2dcded93d2d6800bae04"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dd611131d82d7fc4212b555eb1103160bdad302"
        },
        {
          "url": "https://git.kernel.org/stable/c/01118321e0c8a5f3ece57d0d377bfc92d83cd210"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf7e9040fc52c922db947f9c6c36f07377c52ea"
        }
      ],
      "title": "f2fs: fix UAF issue in f2fs_merge_page_bio()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40054",
    "datePublished": "2025-10-28T11:48:29.073Z",
    "dateReserved": "2025-04-16T07:20:57.157Z",
    "dateUpdated": "2026-08-23T12:45:24.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/netconsole.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            },
            {
              "lessThan": "3126a2f98beaec5a554a1fb31c46db1e8542665e",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            },
            {
              "lessThan": "74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            },
            {
              "lessThan": "82aec772fca2223bc5774bd9af486fd95766e578",
              "status": "affected",
              "version": "c62c0a17f9b7398022f9eebe547878033264f81f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/netconsole.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: avoid OOB reads, msg is not nul-terminated\n\nmsg passed to netconsole from the console subsystem is not guaranteed\nto be nul-terminated. Before recent\ncommit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\")\nthe message would be placed in printk_shared_pbufs, a static global\nbuffer, so KASAN had harder time catching OOB accesses. Now we see:\n\n    printk: console [netcon_ext0] enabled\n    BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240\n    Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594\n\n    CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9\n    Call Trace:\n     kasan_report+0xe4/0x120\n     string+0x1f7/0x240\n     vsnprintf+0x655/0xba0\n     scnprintf+0xba/0x120\n     netconsole_write+0x3fe/0xa10\n     nbcon_emit_next_record+0x46e/0x860\n     nbcon_kthread_func+0x623/0x750\n\n    Allocated by task 1:\n     nbcon_alloc+0x1ea/0x450\n     register_console+0x26b/0xe10\n     init_netconsole+0xbb0/0xda0\n\n    The buggy address belongs to the object at ffff88813b6d4000\n                which belongs to the cache kmalloc-4k of size 4096\n    The buggy address is located 0 bytes to the right of\n                allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In a reasonable high-impact deployment, an internet-facing firewall/router can have netfilter LOG/nft log rules and extended netconsole with release prepend enabled, so unauthenticated remote packets can create printk records that flow into the vulnerable netconsole path. Netconsole itself sends UDP output rather than receiving commands, but the vulnerable code is reachable through network-triggered kernel logging.\nAC:L - Once the affected netconsole mode is configured and a log record is generated, the `%s` overread is deterministic and requires no race or attacker-uncontrolled timing. The non-fragmented path is easy to hit with ordinary short log messages.\nPR:N - For the network logging scenario, the attacker only sends packets that match an already configured logging rule and needs no account or privileges on the vulnerable host. Netconsole/configfs setup is an environmental prerequisite, not a per-attack privilege requirement.\nUI:N - No victim user action is required after the affected logging configuration is present. The attacker can trigger log generation directly.\nS:U - The vulnerability is in the kernel\u2019s own console/logging path and impacts kernel memory on the same host security authority. It does not cross a VM, IOMMU, or similar separate security boundary.\nC:H - The bug is an out-of-bounds read caused by treating a length-delimited printk buffer as NUL-terminated, allowing reads past the valid message into adjacent printk/slab memory. The leaked bytes can be transmitted in netconsole UDP output and repeated, so confidentiality impact is high.\nI:N - The vulnerable operation is a read-only string scan/copy into the netconsole transmit buffer. I found no out-of-bounds write, object corruption, or control-flow modification primitive.\nA:H - The fix commit shows a KASAN slab-out-of-bounds BUG in this path, and the unbounded `%s` scan can read past the allocation until a NUL byte or fault. Repeated attacker-triggered log messages can therefore reasonably cause kernel oops/panic or severe logging-path disruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T18:34:53.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fe132c4873f9eb1b86ddbf31216e9d961a0b8b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3126a2f98beaec5a554a1fb31c46db1e8542665e"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ab1456eaa3b2eb986138f9e1f4cb37e73b6f58"
        },
        {
          "url": "https://git.kernel.org/stable/c/82aec772fca2223bc5774bd9af486fd95766e578"
        }
      ],
      "title": "netconsole: avoid OOB reads, msg is not nul-terminated",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43197",
    "datePublished": "2026-05-06T11:28:04.829Z",
    "dateReserved": "2026-05-01T14:12:55.992Z",
    "dateUpdated": "2026-08-09T18:34:53.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) subsystem. This vulnerability occurs due to incorrect delta tracking when source and destination registers are the same during register value adjustments. This can lead to a mismatch between the BPF verifier\u0027s analysis and the actual runtime behavior of BPF programs, potentially allowing a malicious BPF program to bypass security checks."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-393",
                "description": "Return of Wrong Status Code",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:44:57.727Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53092"
          },
          {
            "name": "RHBZ#2492362",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492362"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53092.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: bpf: Fix linked reg delta tracking when src_reg == dst_reg",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1509c1ae9185ec7103899967ed788b6eebab3fcc",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            },
            {
              "lessThan": "d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            },
            {
              "lessThan": "cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            },
            {
              "lessThan": "d7f14173c0d5866c3cae759dee560ad1bed10d2e",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix linked reg delta tracking when src_reg == dst_reg\n\nConsider the case of rX += rX where src_reg and dst_reg are pointers to\nthe same bpf_reg_state in adjust_reg_min_max_vals(). The latter first\nmodifies the dst_reg in-place, and later in the delta tracking, the\nsubsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the\npost-{add,sub} value instead of the original source.\n\nThis is problematic since it sets an incorrect delta, which sync_linked_regs()\nthen propagates to linked registers, thus creating a verifier-vs-runtime\nmismatch. Fix it by just skipping this corner case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the local `bpf(BPF_PROG_LOAD)` syscall while verifying attacker-supplied BPF instructions, not through network or physical input.\nAC:L - The attacker controls the BPF instruction stream and can construct the linked-register `src_reg == dst_reg` sequence; there is no race or external state requirement beyond passing the verifier path.\nPR:L - The affected verifier logic is gated by `CAP_BPF`, but it is also reachable through delegated BPF tokens with namespaced `CAP_BPF`; under the required higher-severity choice this is Low rather than High.\nUI:N - No victim action is needed after the attacker can invoke `bpf(BPF_PROG_LOAD)` with the crafted program.\nS:U - The impact is within the same kernel security authority; this is a standard local kernel privilege escalation/verifier bypass rather than a VM or IOMMU boundary crossing.\nC:H - The bug creates a verifier-versus-runtime bounds mismatch, which can allow accepted BPF programs to perform out-of-bounds reads and develop arbitrary kernel memory disclosure primitives.\nI:H - Incorrect verifier bounds can allow out-of-bounds writes through map or memory accesses after program load, making arbitrary kernel memory modification and privilege escalation defensible.\nA:H - Even if not fully weaponized for read/write primitives, an accepted unsafe BPF program can corrupt kernel memory or trigger an oops/panic, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:31.512Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1509c1ae9185ec7103899967ed788b6eebab3fcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d88e8e4a3b52bd5b2ff3eceba4b29d1b5506d066"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc86a8b0a1c54d2bccf6f68cf49b82dea91b84de"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7f14173c0d5866c3cae759dee560ad1bed10d2e"
        }
      ],
      "title": "bpf: Fix linked reg delta tracking when src_reg == dst_reg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53092",
    "datePublished": "2026-06-24T16:30:31.168Z",
    "dateReserved": "2026-06-09T07:44:35.384Z",
    "dateUpdated": "2026-08-23T12:45:31.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23d8ea1e303b5f32d883757a4a707e791dbc9808",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "97e2d08de282ef76f84ab4ccd00f1acb3f5f999e",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "388468f7e7d1eab092cf2a39fdfb502e52019ec6",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "dc278e9bf2b9513a763353e6b9cc21e0f532954e",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e9c309ded295b7f8849097d71ae231456ca79f78",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b80056bd75a16e4550873ecefe12bc8fd190b1cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b6075046470c8756242dfe3fd058813636f69a3",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in `blk_mq_submit_bio()`, reached from local block I/O submission (`submit_bio` via read/write, filesystem I/O, or io_uring). Reliable exploitation requires a `blk_plug` with populated `cached_rqs`, which occurs when io_uring submits batches of 3+ plugged read/write operations (`blk_start_plug_nr_ios`); remote-only paths like nfsd/ksmbd/nvmet typically use `blk_start_plug()` with `nr_ios=1` and do not populate the cached-request list needed to hit the peek-without-pop window.\nAC:L - An attacker controls both sides of the race by batching io_uring I/O and inducing a sleep between peek and pop (e.g., memory pressure during bio split/allocation, or `bio_integrity_prep()` blocking on PI-capable enterprise/cloud NVMe). Plug flush on any schedule is deterministic kernel behavior, not an uncontrollable environmental condition.\nPR:L - Triggering requires only an unprivileged local process able to perform block-backed I/O (normal file read/write or io_uring readv/writev to accessible storage); no root, `CAP_SYS_ADMIN`, or special kernel capabilities are needed beyond standard filesystem/device access available to any local user.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own I/O submissions through io_uring or direct block I/O; no action by another user or administrator is required.\nS:U - Impact is confined to kernel memory via a block-layer use-after-free on `struct request`; this is standard kernel privilege escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a use-after-free of a `struct request` object; the attacker can influence post-free heap contents and dereference freed fields (`rq-\u003eq`, `rq-\u003emq_hctx`, `rq-\u003ebio`), enabling arbitrary kernel memory read primitives.\nI:H - UAF on `struct request` permits controlled writes through subsequent use of the dangling object (`rq-\u003ecmd_flags`, `queuelist`, bio attachment in `blk_mq_bio_to_request`), enabling heap corruption and potential arbitrary code execution in kernel context.\nA:H - The freed request is dereferenced during `blk_mq_use_cached_rq()` and subsequent request setup, causing kernel oops/panic; even without full exploitation, UAF reliably threatens system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:11.145Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e"
        },
        {
          "url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"
        }
      ],
      "title": "blk-mq: pop cached request if it is usable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64017",
    "datePublished": "2026-07-19T15:39:11.989Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-19T16:28:11.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9dfb09cb0abbf92a06f93e0715e163aa188a84da",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "4824e3bcc68f8d678b409039d1bb48c7b5ea73dc",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "61127dd20920bf28460a1609aabb0dafa2f54fac",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "c268331845ee00dbdbccb000826bb612dff2bee7",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "e3815d1ffbb9be4f1605ddc3b427557893461683",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "02d378828af8bb74f6c2f4d2bee3c77cf16c861e",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "177a25be1195f8bdc6160ba5f1a5699f7041c985",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "43b25879f004c98defa2776bedc6ca4763c51945",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: drain bus_reset work on device removal\n\nbrcmf_fw_crashed() and the debugfs \"reset\" entry both schedule\ndrvr-\u003ebus_reset, whose callback recovers drvr through container_of()\nand dereferences it.  The removal path frees drvr (brcmf_free -\u003e\nwiphy_free) without draining the work, so a bus_reset callback pending\nor running during removal can outlive drvr.\n\nCancellation cannot live in brcmf_detach() or brcmf_free(): the work\ncallback reaches teardown through the bus .reset op (PCIe\nbrcmf_pcie_reset -\u003e brcmf_detach; SDIO brcmf_sdio_bus_reset -\u003e\nbrcmf_sdiod_remove -\u003e brcmf_free), so cancelling there would wait for\nthe running work and deadlock.\n\nAdd a per-bus mutex (bus_reset_lock) and route all arming through\nbrcmf_bus_schedule_reset(), which under the lock skips when the bus is\nmarked removing.  Each bus remove entry calls\nbrcmf_bus_cancel_reset_work(), which under the same lock sets removing\nand cancels the work.  Holding the mutex across cancel_work_sync() makes\nthe set-removing + drain step atomic.  Every producer reaches the arming\npath from process context -- the PCIe firmware-halt notification runs in\nthe threaded IRQ handler (brcmf_pcie_isr_thread) and the SDIO hostmail\npath runs from the data workqueue -- so the mutex is taken only in\nsleepable contexts.  Where applicable the remove entry first stops the\nfirmware-crash producer: on PCIe mask the mailbox and synchronize_irq;\non SDIO unregister the bus interrupt and cancel the data worker, which\nalso reports firmware halts through brcmf_fw_crashed().  The mutex is\ninitialized at bus allocation.  The SDIO suspend power-off path frees\ndrvr through the same brcmf_sdiod_remove() and takes the same lock;\nresume re-allows the work only on a successful re-probe.\n\nAlso guard brcmf_fw_crashed() against a NULL bus_if/drvr: it can fire\nbefore brcmf_attach() wires up drvr, and it dereferences drvr\n(bphy_err/brcmf_dev_coredump) before reaching the arming gate.\n\nThe bus_reset work is shared across buses, so the drain is applied to\nevery remove path: PCIe (the .reset op introduced by the Fixes commit),\nSDIO (arms the same work through brcmf_fw_crashed()), and USB (via the\ndebugfs \"reset\" entry).  cancel_work_sync() drains a running or pending\nbus_reset work item before removal frees drvr, and patch 1/2 makes the\nscratch-buffer release safe when reset teardown has already released\nthose DMA buffers.\n\nThis patch fixes the lifetime of the bus_reset work item itself.  It does\nnot attempt to address the separate, pre-existing lifetime of the\nasynchronous firmware completion started by the PCIe reset path.  That\ncallback needs its own lifetime/ownership protocol and is being tracked\nseparately.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - bus_reset is armed by brcmf_fw_crashed() when Broadcom fullmac signals FWHALT (PCIe mailbox ISR thread / SDIO hostmail). An adjacent 802.11 attacker can induce that halt with malformed frames; the pending work then races device removal (USB hot-unplug, SDIO suspend power-off) that frees drvr without draining the work.\nAC:L - The attacker repeatedly induces firmware halts to schedule bus_reset and can align removal (USB unplug on shared dongles/kiosks, or SDIO suspend) so the work runs after wiphy_free; both sides are attacker-influenced and freely retryable, so success does not depend on uncontrollable timing.\nPR:N - FWHALT delivery and brcmf_fw_crashed() need no host credentials; concurrent free via USB disconnect or automatic SDIO power-cut suspend likewise requires no account or capability. The debugfs reset path is root-only but is not the highest-severity reachability.\nUI:N - Firmware-halt recovery and device removal/suspend paths run in kernel workqueues and bus callbacks without the victim opening a file, mounting media, or otherwise interacting.\nS:U - The UAF corrupts host-kernel heap (struct brcmf_pub embedded in the wiphy) within the same kernel security authority; it is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Use-after-free of drvr via container_of on the freed bus_reset work_struct lets an attacker reallocate the wiphy/drvr slab and observe attacker-controlled object contents through subsequent driver dereferences, yielding an arbitrary kernel read primitive.\nI:H - The recycled work_struct/drvr is dispatched by the workqueue (func pointer / bus_if ops), enabling heap corruption and control-flow hijack when brcmf_core_bus_reset runs on attacker-shaped memory after brcmf_free/wiphy_free.\nA:H - Even without full exploitation, running bus_reset after wiphy_free dereferences freed drvr/bus_if state and reliably causes kernel oops/panic or driver teardown failure, denying availability of the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:44.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9dfb09cb0abbf92a06f93e0715e163aa188a84da"
        },
        {
          "url": "https://git.kernel.org/stable/c/4824e3bcc68f8d678b409039d1bb48c7b5ea73dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/61127dd20920bf28460a1609aabb0dafa2f54fac"
        },
        {
          "url": "https://git.kernel.org/stable/c/c268331845ee00dbdbccb000826bb612dff2bee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3815d1ffbb9be4f1605ddc3b427557893461683"
        },
        {
          "url": "https://git.kernel.org/stable/c/02d378828af8bb74f6c2f4d2bee3c77cf16c861e"
        },
        {
          "url": "https://git.kernel.org/stable/c/177a25be1195f8bdc6160ba5f1a5699f7041c985"
        },
        {
          "url": "https://git.kernel.org/stable/c/43b25879f004c98defa2776bedc6ca4763c51945"
        }
      ],
      "title": "wifi: brcmfmac: drain bus_reset work on device removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64586",
    "datePublished": "2026-08-06T07:06:27.158Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-23T12:45:44.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/cls_lock_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8ade01170a27d8ede0d761c255268af81e417f8",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "001835c599899ef1bd3506a815110a6374451554",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "7c422364acd93d7da1dfc27d6b54635a269653a1",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "02430f6f729b297e803d0605871f0a670b4eafd6",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "57ba829804fe6d34bbac3b826c4b15c1caa54862",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "89df5d71f83f8e2781286798fd8ae5e42cf5f1a7",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "a54be593d0b749161b08a1e56189b2cb9114267a",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            },
            {
              "lessThan": "a109a556115271ca7896dcda7b4b7e45e156c227",
              "status": "affected",
              "version": "d4ed4a530562881cc5225050e42d96034f405aae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/cls_lock_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n   check. ceph_start_decoding() accepts struct_len=0 as valid -- the\n   internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n   OSD sends struct_len=0, ceph_start_decoding() returns success with\n   p == end. The immediately following bare ceph_decode_32(p) then reads\n   4 bytes past the validated buffer boundary. The garbage value is\n   passed directly to kzalloc_objs() as the locker count.\n\n   The sibling function decode_watchers() in osd_client.c already uses\n   ceph_decode_32_safe() after its own ceph_start_decoding() call.\n   decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n   bounds check. If an OSD crafts num_lockers such that the loop\n   advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n   one byte past the validated buffer boundary. The result is passed\n   directly into *type, which is used as a lock type discriminator by\n   callers, giving an OSD-controlled one-byte OOB read with direct\n   influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n  ceph_decode_32(p) -\u003e ceph_decode_32_safe(p, end, *num_lockers,\n                                           err_inval)\n  ceph_decode_8(p)  -\u003e ceph_decode_8_safe(p, end, *type,\n                                          err_free_lockers)\n\nThe goto targets differ intentionally:\n  err_inval: is a new label returning -EINVAL directly. It is used for\n  the pre-allocation failure path where *lockers is not yet allocated\n  and must not be passed to ceph_free_lockers().\n\n  err_free_lockers: is the existing label. It is used for the\n  post-allocation failure path where *lockers is allocated and must\n  be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD can deterministically send struct_len=0 or craft num_lockers so the decode pointer reaches end, triggering both bare decodes on every attempt without races, special memory layout, or rare kernel configuration.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Bare ceph_decode_32/8 past the validated reply boundary perform slab out-of-bounds reads of adjacent kernel memory; the leaked u32 can drive kzalloc_objs() sizing and the OOB u8 directly controls the lock-type field consumed by RBD lock logic.\nI:H - Attacker-influenced out-of-bounds values feed heap allocation sizing and lock-type discrimination in kernel lock-handling paths, providing memory-corruption primitives in a privileged parser that can be leveraged beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and attacker-controlled locker counts can force very large kzalloc attempts causing severe memory pressure, OOM conditions, and loss of availability on RBD client hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:46.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8ade01170a27d8ede0d761c255268af81e417f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/001835c599899ef1bd3506a815110a6374451554"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c422364acd93d7da1dfc27d6b54635a269653a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/02430f6f729b297e803d0605871f0a670b4eafd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/57ba829804fe6d34bbac3b826c4b15c1caa54862"
        },
        {
          "url": "https://git.kernel.org/stable/c/89df5d71f83f8e2781286798fd8ae5e42cf5f1a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a54be593d0b749161b08a1e56189b2cb9114267a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a109a556115271ca7896dcda7b4b7e45e156c227"
        }
      ],
      "title": "libceph: fix two unsafe bare decodes in decode_lockers()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68082",
    "datePublished": "2026-08-08T09:17:45.394Z",
    "dateReserved": "2026-07-30T09:28:09.367Z",
    "dateUpdated": "2026-08-23T12:45:46.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_minisocks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "0fe4636665d14a258de70b4f3e8248e6d42038f1",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "234f9ffbd9b2c1b24ec67200ea3cff07401bec48",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "22cec809b048495310f206d9abbcdbbfbdce3ae3",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "lessThan": "a28c4fcbf774e23b4779cae468e3497a5ad1f4a1",
              "status": "affected",
              "version": "282f23c6ee343126156dd41218b22ece96d747e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "86791bbfe5ed7b275be040cfeff049a1624af1b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "61f69dc4e40e41b0018f00fa4aeb23d3239556fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34fb350281ced2a72707a5c0064f69992d440edb",
              "versionType": "git"
            },
            {
              "lessThan": "3.1",
              "status": "affected",
              "version": "3.0.58",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.37",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.25",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_minisocks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.0.58",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: challenge ACK for non-exact RST in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A\nnon-exact RST therefore removes the request instead of eliciting a\nchallenge ACK.\n\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\nin-window RST must trigger a challenge ACK and be dropped.\n\nApply that check before the ACK-field validation, following the RFC\nsequence-number, RST, then ACK processing order.  Factor the per-netns\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\ncan share it.  Use the request socket\u0027s send_ack() callback and its own\nout-of-window ACK timestamp to send and rate-limit the response."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in tcp_check_req() on the core TCP receive path (ip_rcv/tcp_v4_rcv or tcp_v6_rcv \u2192 __inet_lookup_skb on TCP_NEW_SYN_RECV \u2192 tcp_check_req); any remote host that can deliver TCP segments to an internet-facing listener reaches it with no local access.\nAC:L - An attacker controls the forged RST (source/dest ports, SEQ sweep across the SYN-RECEIVED window up to tcp_synack_window/65535) and can retry on every handshake; no race, rare config, or victim-only state outside attacker influence is required beyond routine IP spoofing or on-path delivery.\nPR:N - Processing occurs on the pre-authentication TCP handshake path for embryonic request sockets; no credentials, capabilities, or local account are needed\u2014only the ability to send (or spoof) TCP packets to the target listener.\nUI:N - Handshake teardown is triggered automatically when the kernel receives the crafted RST during SYN-RECEIVED; no victim must open files, click links, or perform any other action.\nS:U - Impact is confined to incorrect TCP connection-state handling within the same host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:N - This is a protocol state-machine logic flaw with no memory corruption, out-of-bounds access, use-after-free, or information disclosure\u2014only embryonic request-socket teardown occurs.\nI:L - A non-exact in-window RST causes unauthorized modification of TCP connection state by dropping the embryonic request socket (embryonic_reset/inet_csk_reqsk_queue_drop) instead of preserving it per RFC 5961/RFC 9293.\nA:H - Repeated spoofed in-window RSTs during SYN-RECEIVED can prevent TCP handshakes from completing on arbitrary listening services (HTTPS, SSH, databases, load balancers), causing sustained denial of service without kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:51.263Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48"
        },
        {
          "url": "https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1"
        }
      ],
      "title": "tcp: challenge ACK for non-exact RST in SYN-RECEIVED",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68118",
    "datePublished": "2026-08-10T11:58:38.000Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-23T12:45:51.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96248aeddde794227a49af1a332a1e21b3c15d56",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "c202aa03388fd1889b7aa4f7d677c49e22cd9700",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "2a1127c1c58b4f15a93f2fd56ff7c2c3d611d5c5",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "05536cad35f27b520d4b6f0e57c8cc5bfb6b0502",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "99719b5da9320ed344daee87d9c73d321a98f252",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "63d78b546eefc38ad9898dc839bfc94811ede547",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "4c483644d1a7709efe7d1be7dbf88cf4008a7864",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "749d7aa0377aae32af8c0a4ad43371e7bf830ab5",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsuper: fix emergency thaw deadlock on frozen block devices\n\ndo_thaw_all_callback() calls bdev_thaw() while holding sb-\u003es_umount\nexclusively. If the block device was frozen via bdev_freeze() dropping\nthe last block layer freeze reference calls fs_bdev_thaw() which\nreacquires s_umount:\n\n  do_thaw_all_callback(sb)\n    super_lock_excl(sb)                     # holds sb-\u003es_umount\n    bdev_thaw(sb-\u003es_bdev)\n      mutex_lock(\u0026bdev-\u003ebd_fsfreeze_mutex)\n      # bd_fsfreeze_count drops 1 -\u003e 0\n      bd_holder_ops-\u003ethaw == fs_bdev_thaw\n        get_bdev_super(bdev)\n          bdev_super_lock(bdev, true)\n            super_lock(sb, true)\n              down_write(\u0026sb-\u003es_umount)     # same task: deadlock\n\nThe emergency thaw worker deadlocks against itself holding both\ns_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,\nfreeze, or thaw of that filesystem and block device.\n\n  [   81.878470] sysrq: Show Blocked State\n  [   81.880140] task:kworker/0:1     state:D stack:0     pid:11    tgid:11    ppid:2      task_flags:0x4208060 flags:0x00080000\n  [   81.884876] Workqueue: events do_thaw_all\n  [   81.886656] Call Trace:\n  [   81.887759]  \u003cTASK\u003e\n  [   81.888763]  __schedule+0x579/0x1420\n  [   81.890372]  schedule+0x3a/0x100\n  [   81.891794]  schedule_preempt_disabled+0x15/0x30\n  [   81.893848]  rwsem_down_write_slowpath+0x1ea/0x900\n  [   81.895191]  ? __pfx_do_thaw_all_callback+0x10/0x10\n  [   81.896528]  down_write+0xbd/0xc0\n  [   81.897505]  super_lock+0x91/0x180\n  [   81.898457]  ? __mutex_lock+0xa99/0x1140\n  [   81.900748]  ? __mutex_unlock_slowpath+0x1f/0x400\n  [   81.902069]  bdev_super_lock+0x5b/0x150\n  [   81.903132]  get_bdev_super+0x10/0x60\n  [   81.904042]  fs_bdev_thaw+0x23/0xf0\n  [   81.904755]  bdev_thaw+0x82/0x100\n  [   81.905484]  do_thaw_all_callback+0x2c/0x50\n  [   81.906298]  __iterate_supers+0x5d/0x130\n  [   81.907067]  do_thaw_all+0x20/0x40\n  [   81.907739]  process_one_work+0x206/0x5e0\n  [   81.908545]  worker_thread+0x1e2/0x3c0\n  [   81.909339]  ? __pfx_worker_thread+0x10/0x10\n  [   81.910171]  kthread+0xf4/0x130\n  [   81.910799]  ? __pfx_kthread+0x10/0x10\n  [   81.911528]  ret_from_fork+0x2e2/0x3b0\n  [   81.912259]  ? __pfx_kthread+0x10/0x10\n  [   81.913010]  ret_from_fork_asm+0x1a/0x30\n  [   81.913806]  \u003c/TASK\u003e\n\nbdev_super_lock() even documents the violated requirement with\nlockdep_assert_not_held(\u0026sb-\u003es_umount).\n\nAcquiring bd_fsfreeze_mutex under s_umount also inverts the\nbd_fsfreeze_mutex vs. s_umount ordering established by\nbdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer\nfreeze even when the recursive path isn\u0027t hit.\n\nFix this by not holding s_umount around the bdev_thaw() loop at all. Pin\nthe superblock with an active reference instead as\nfilesystems_freeze_callback() does. The active reference keeps the\nsuperblock from being shut down and so -\u003es_bdev stays valid without\nholding s_umount. The block-layer-held freeze is dropped by\nfs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as\na regular unfreeze would and thaw_super_locked() handles\nfilesystem-level freezes as before.\n\nThe emergency thaw path has deadlocked like this in one form or\nanother for a long long time but the current exclusively-held\nshape dates back to commit [1] where thaw_bdev() already ended in\nthaw_super() with s_umount held by do_thaw_all_callback()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:53.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96248aeddde794227a49af1a332a1e21b3c15d56"
        },
        {
          "url": "https://git.kernel.org/stable/c/c202aa03388fd1889b7aa4f7d677c49e22cd9700"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a1127c1c58b4f15a93f2fd56ff7c2c3d611d5c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/05536cad35f27b520d4b6f0e57c8cc5bfb6b0502"
        },
        {
          "url": "https://git.kernel.org/stable/c/99719b5da9320ed344daee87d9c73d321a98f252"
        },
        {
          "url": "https://git.kernel.org/stable/c/63d78b546eefc38ad9898dc839bfc94811ede547"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c483644d1a7709efe7d1be7dbf88cf4008a7864"
        },
        {
          "url": "https://git.kernel.org/stable/c/749d7aa0377aae32af8c0a4ad43371e7bf830ab5"
        }
      ],
      "title": "super: fix emergency thaw deadlock on frozen block devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68132",
    "datePublished": "2026-08-10T11:58:55.196Z",
    "dateReserved": "2026-07-30T09:28:09.370Z",
    "dateUpdated": "2026-08-23T12:45:53.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b050d09dd1a0ddae83bf012cf4956b7a960235f",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "6e0241f6cbb149d926ee8efee2c734fea71452cf",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "f93c89392bd3b180b5b7abc6fdae8e3dd667a313",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "4131dd0b6f67acddd616ed7c244e1d3eedd46e7b",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "d981098b76756ed71666a27518eeb69883657c43",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "8ddc2eb0d2da9c83f54f1e5720525b461b8480c4",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "fb29e1b41052488ee3f2d115d4a870497ebd7f7d",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            },
            {
              "lessThan": "f43ee0c0730d6191629b5ee1ceae27b1ebfdc047",
              "status": "affected",
              "version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: serialize qdisc_rtab_list against concurrent get/put\n\nqdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly\nlinked list qdisc_rtab_list and a plain non-atomic \u0027int refcnt\u0027 with no\nlock. This was only safe because every caller historically held the RTNL\nmutex, which serialized all rate-table lookups, inserts and frees.\n\nThat invariant no longer holds. cls_flower sets\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through\ntcf_exts_validate_ex() -\u003e tcf_action_init() -\u003e tcf_action_init_1() -\u003e\ntcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each\nadding a flower filter with a police action carrying the same rate, then\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a\nuse-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.\nqdisc_rtab_list is a single global (not per-netns), so the corrupted\nobject is shared system-wide.\n\n  BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160\n   qdisc_put_rtab+0x12f/0x160\n   tcf_police_init+0xda9/0x1590\n   tcf_action_init_1+0x460/0x6b0\n   tcf_action_init+0x439/0xa40\n   tcf_exts_validate_ex+0x42d/0x550\n   fl_change+0xddd/0x7da0\n   tc_new_tfilter+0xaa7/0x2420\n   rtnetlink_rcv_msg+0x95e/0xe90\n  which belongs to the cache kmalloc-2k of size 2048\n\nProtect qdisc_rtab_list and the refcount with a dedicated spinlock. The\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before\ntaking the lock; if a concurrent inserter added an identical table in the\nmeantime the freshly allocated one is freed under the lock, so no\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and\nunlinks under the same lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg\u2192tc_new_tfilter\u2192fl_change\u2192tcf_police_init\u2192qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:55.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b050d09dd1a0ddae83bf012cf4956b7a960235f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e0241f6cbb149d926ee8efee2c734fea71452cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/f93c89392bd3b180b5b7abc6fdae8e3dd667a313"
        },
        {
          "url": "https://git.kernel.org/stable/c/4131dd0b6f67acddd616ed7c244e1d3eedd46e7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d981098b76756ed71666a27518eeb69883657c43"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ddc2eb0d2da9c83f54f1e5720525b461b8480c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047"
        }
      ],
      "title": "net/sched: serialize qdisc_rtab_list against concurrent get/put",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68138",
    "datePublished": "2026-08-10T11:59:01.744Z",
    "dateReserved": "2026-07-30T09:28:09.370Z",
    "dateUpdated": "2026-08-23T12:45:55.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}