Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1090
Vulnerability from certfr_avis - Published: 2026-08-28 - Updated: 2026-08-28
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.105-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-74632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74632"
},
{
"name": "CVE-2026-74452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74452"
},
{
"name": "CVE-2026-74649",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74649"
},
{
"name": "CVE-2026-74441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74441"
},
{
"name": "CVE-2026-68480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68480"
},
{
"name": "CVE-2026-74517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74517"
},
{
"name": "CVE-2026-74450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74450"
},
{
"name": "CVE-2026-74481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74481"
},
{
"name": "CVE-2026-68138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68138"
},
{
"name": "CVE-2026-74597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74597"
},
{
"name": "CVE-2026-74669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74669"
},
{
"name": "CVE-2026-74482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74482"
},
{
"name": "CVE-2026-74598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74598"
},
{
"name": "CVE-2026-74540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74540"
},
{
"name": "CVE-2026-74440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74440"
},
{
"name": "CVE-2026-74502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74502"
},
{
"name": "CVE-2026-53092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53092"
},
{
"name": "CVE-2026-74599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74599"
},
{
"name": "CVE-2026-74569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74569"
},
{
"name": "CVE-2026-74581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
},
{
"name": "CVE-2026-74543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74543"
},
{
"name": "CVE-2026-74696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74696"
},
{
"name": "CVE-2026-74612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74612"
},
{
"name": "CVE-2026-74563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74563"
},
{
"name": "CVE-2026-74457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74457"
},
{
"name": "CVE-2026-74505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74505"
},
{
"name": "CVE-2026-74523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74523"
},
{
"name": "CVE-2026-74453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74453"
},
{
"name": "CVE-2026-74693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74693"
},
{
"name": "CVE-2026-74557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74557"
},
{
"name": "CVE-2026-74607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74607"
},
{
"name": "CVE-2026-74461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74461"
},
{
"name": "CVE-2026-74514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74514"
},
{
"name": "CVE-2026-68132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68132"
},
{
"name": "CVE-2026-74465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74465"
},
{
"name": "CVE-2026-74630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74630"
},
{
"name": "CVE-2026-74682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74682"
},
{
"name": "CVE-2026-74488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74488"
},
{
"name": "CVE-2026-74683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74683"
},
{
"name": "CVE-2025-40054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40054"
},
{
"name": "CVE-2026-74444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74444"
},
{
"name": "CVE-2026-74724",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74724"
},
{
"name": "CVE-2026-74657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74657"
},
{
"name": "CVE-2026-74676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74676"
},
{
"name": "CVE-2026-74460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74460"
},
{
"name": "CVE-2026-74586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74586"
},
{
"name": "CVE-2026-64017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64017"
},
{
"name": "CVE-2026-68276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68276"
},
{
"name": "CVE-2026-74661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74661"
},
{
"name": "CVE-2026-74688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74688"
},
{
"name": "CVE-2026-74572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74572"
},
{
"name": "CVE-2026-74726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74726"
},
{
"name": "CVE-2026-74531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74531"
},
{
"name": "CVE-2026-74549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74549"
},
{
"name": "CVE-2026-68267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68267"
},
{
"name": "CVE-2026-74470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74470"
},
{
"name": "CVE-2026-74478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74478"
},
{
"name": "CVE-2026-74566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74566"
},
{
"name": "CVE-2026-68166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68166"
},
{
"name": "CVE-2026-74473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74473"
},
{
"name": "CVE-2026-74467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74467"
},
{
"name": "CVE-2026-74476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74476"
},
{
"name": "CVE-2026-74691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74691"
},
{
"name": "CVE-2026-74490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74490"
},
{
"name": "CVE-2026-74730",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74730"
},
{
"name": "CVE-2026-68169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68169"
},
{
"name": "CVE-2026-74580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74580"
},
{
"name": "CVE-2026-74565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74565"
},
{
"name": "CVE-2026-74660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74660"
},
{
"name": "CVE-2026-74454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74454"
},
{
"name": "CVE-2026-74493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74493"
},
{
"name": "CVE-2026-74463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74463"
},
{
"name": "CVE-2026-74583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74583"
},
{
"name": "CVE-2026-74725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74725"
},
{
"name": "CVE-2026-74665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74665"
},
{
"name": "CVE-2026-74464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74464"
},
{
"name": "CVE-2026-74636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74636"
},
{
"name": "CVE-2026-74522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74522"
},
{
"name": "CVE-2026-74704",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74704"
},
{
"name": "CVE-2026-74689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74689"
},
{
"name": "CVE-2026-74710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74710"
},
{
"name": "CVE-2026-74622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74622"
},
{
"name": "CVE-2026-74474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74474"
},
{
"name": "CVE-2026-74604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74604"
},
{
"name": "CVE-2026-74451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74451"
},
{
"name": "CVE-2026-74555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74555"
},
{
"name": "CVE-2026-74623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74623"
},
{
"name": "CVE-2026-74456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74456"
},
{
"name": "CVE-2026-74535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74535"
},
{
"name": "CVE-2026-74552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74552"
},
{
"name": "CVE-2026-74714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74714"
},
{
"name": "CVE-2026-74664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74664"
},
{
"name": "CVE-2026-74445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74445"
},
{
"name": "CVE-2026-43197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43197"
},
{
"name": "CVE-2026-74620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74620"
},
{
"name": "CVE-2026-74732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74732"
},
{
"name": "CVE-2026-74499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74499"
},
{
"name": "CVE-2026-74675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74675"
},
{
"name": "CVE-2026-74685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74685"
},
{
"name": "CVE-2026-74701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74701"
},
{
"name": "CVE-2026-74670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74670"
},
{
"name": "CVE-2026-74504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74504"
},
{
"name": "CVE-2026-74637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74637"
},
{
"name": "CVE-2026-74447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74447"
},
{
"name": "CVE-2026-74536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74536"
},
{
"name": "CVE-2026-74589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74589"
},
{
"name": "CVE-2026-74479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74479"
},
{
"name": "CVE-2026-74492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74492"
},
{
"name": "CVE-2026-74641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74641"
},
{
"name": "CVE-2026-68159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68159"
},
{
"name": "CVE-2026-74694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74694"
},
{
"name": "CVE-2026-68367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68367"
},
{
"name": "CVE-2026-74614",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74614"
},
{
"name": "CVE-2026-74442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74442"
},
{
"name": "CVE-2026-68273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68273"
},
{
"name": "CVE-2026-74684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74684"
},
{
"name": "CVE-2026-74608",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74608"
},
{
"name": "CVE-2026-74484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74484"
},
{
"name": "CVE-2026-74459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74459"
},
{
"name": "CVE-2026-74471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74471"
},
{
"name": "CVE-2026-74553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74553"
},
{
"name": "CVE-2026-74671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74671"
},
{
"name": "CVE-2026-74515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74515"
},
{
"name": "CVE-2026-74448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74448"
},
{
"name": "CVE-2026-74592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74592"
},
{
"name": "CVE-2026-64586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64586"
},
{
"name": "CVE-2026-74609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74609"
},
{
"name": "CVE-2026-74487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74487"
},
{
"name": "CVE-2026-74668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74668"
},
{
"name": "CVE-2026-74500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74500"
},
{
"name": "CVE-2026-74618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74618"
},
{
"name": "CVE-2026-74498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74498"
},
{
"name": "CVE-2026-74615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74615"
},
{
"name": "CVE-2026-74524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74524"
},
{
"name": "CVE-2026-74625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74625"
},
{
"name": "CVE-2026-68264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68264"
},
{
"name": "CVE-2026-74446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74446"
},
{
"name": "CVE-2026-74577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74577"
},
{
"name": "CVE-2026-74516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74516"
},
{
"name": "CVE-2026-74590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74590"
},
{
"name": "CVE-2026-74541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74541"
},
{
"name": "CVE-2026-74574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74574"
},
{
"name": "CVE-2026-74567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74567"
},
{
"name": "CVE-2026-74619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74619"
},
{
"name": "CVE-2026-74582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
},
{
"name": "CVE-2026-74519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74519"
},
{
"name": "CVE-2026-74548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74548"
},
{
"name": "CVE-2026-74718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74718"
},
{
"name": "CVE-2026-68118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68118"
},
{
"name": "CVE-2026-74518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74518"
},
{
"name": "CVE-2026-74503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74503"
},
{
"name": "CVE-2026-68322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68322"
},
{
"name": "CVE-2026-74603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74603"
},
{
"name": "CVE-2026-74587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74587"
},
{
"name": "CVE-2026-74663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74663"
},
{
"name": "CVE-2026-74472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74472"
},
{
"name": "CVE-2026-74677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74677"
},
{
"name": "CVE-2026-68082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68082"
},
{
"name": "CVE-2026-74494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74494"
},
{
"name": "CVE-2026-74508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74508"
},
{
"name": "CVE-2026-74672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74672"
},
{
"name": "CVE-2026-74469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74469"
},
{
"name": "CVE-2026-74602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74602"
},
{
"name": "CVE-2026-74483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74483"
},
{
"name": "CVE-2026-74679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74679"
},
{
"name": "CVE-2026-68451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68451"
},
{
"name": "CVE-2026-74717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74717"
},
{
"name": "CVE-2026-74700",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74700"
},
{
"name": "CVE-2026-74610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74610"
},
{
"name": "CVE-2026-74655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74655"
},
{
"name": "CVE-2026-74654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74654"
},
{
"name": "CVE-2026-74658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74658"
},
{
"name": "CVE-2026-74576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74576"
},
{
"name": "CVE-2026-74546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74546"
},
{
"name": "CVE-2026-74680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74680"
},
{
"name": "CVE-2026-74497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74497"
},
{
"name": "CVE-2026-74510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
},
{
"name": "CVE-2026-74455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74455"
},
{
"name": "CVE-2026-74512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74512"
},
{
"name": "CVE-2026-74646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74646"
},
{
"name": "CVE-2026-74588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74588"
},
{
"name": "CVE-2026-68266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68266"
},
{
"name": "CVE-2026-74556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
},
{
"name": "CVE-2026-74532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74532"
},
{
"name": "CVE-2026-74595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74595"
},
{
"name": "CVE-2026-68452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68452"
},
{
"name": "CVE-2026-74692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74692"
},
{
"name": "CVE-2026-74719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74719"
},
{
"name": "CVE-2026-74585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74585"
},
{
"name": "CVE-2026-74651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74651"
},
{
"name": "CVE-2026-74551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74551"
},
{
"name": "CVE-2026-74666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74666"
},
{
"name": "CVE-2026-74705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74705"
},
{
"name": "CVE-2026-68431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68431"
},
{
"name": "CVE-2026-74495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74495"
},
{
"name": "CVE-2026-72111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72111"
},
{
"name": "CVE-2026-68254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68254"
},
{
"name": "CVE-2026-74720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74720"
},
{
"name": "CVE-2026-74547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74547"
},
{
"name": "CVE-2026-74579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74579"
},
{
"name": "CVE-2026-74458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74458"
},
{
"name": "CVE-2026-74647",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74647"
},
{
"name": "CVE-2026-74613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74613"
},
{
"name": "CVE-2026-74525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74525"
},
{
"name": "CVE-2026-74594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74594"
},
{
"name": "CVE-2026-74475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74475"
},
{
"name": "CVE-2026-74659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74659"
},
{
"name": "CVE-2026-68253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68253"
},
{
"name": "CVE-2026-74621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74621"
},
{
"name": "CVE-2025-38525",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38525"
},
{
"name": "CVE-2026-74507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74507"
},
{
"name": "CVE-2026-74606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74606"
},
{
"name": "CVE-2026-74628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74628"
},
{
"name": "CVE-2026-74667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74667"
},
{
"name": "CVE-2026-74601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74601"
},
{
"name": "CVE-2026-74673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74673"
},
{
"name": "CVE-2026-74722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74722"
},
{
"name": "CVE-2026-68198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68198"
},
{
"name": "CVE-2026-74635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74635"
},
{
"name": "CVE-2026-74624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74624"
},
{
"name": "CVE-2026-74678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74678"
},
{
"name": "CVE-2026-74575",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74575"
},
{
"name": "CVE-2026-74480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74480"
},
{
"name": "CVE-2026-74545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74545"
},
{
"name": "CVE-2026-74468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74468"
},
{
"name": "CVE-2026-74631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74631"
},
{
"name": "CVE-2026-74634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74634"
},
{
"name": "CVE-2026-74644",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74644"
},
{
"name": "CVE-2026-74485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74485"
},
{
"name": "CVE-2026-74564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74564"
},
{
"name": "CVE-2026-74616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74616"
},
{
"name": "CVE-2026-74712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74712"
},
{
"name": "CVE-2026-74550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74550"
},
{
"name": "CVE-2026-74509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74509"
},
{
"name": "CVE-2026-74656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74656"
},
{
"name": "CVE-2026-74648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74648"
},
{
"name": "CVE-2026-74650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74650"
},
{
"name": "CVE-2026-74443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74443"
},
{
"name": "CVE-2026-74501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74501"
}
],
"initial_release_date": "2026-08-28T00:00:00",
"last_revision_date": "2026-08-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1090",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-28T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-08-25",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00377",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00377.html"
}
]
}
CVE-2026-74577 (GCVE-0-2026-74577)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-19 16:39
VLAI
EPSS
VEX
Title
net: mpls: initialize rtm_tos in mpls_getroute()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtm_tos in mpls_getroute()
mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE
request by filling a struct rtmsg allocated from an skb whose data
area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every
field of the header except rtm_tos:
r = nlmsg_data(nlh);
r->rtm_family = AF_MPLS;
r->rtm_dst_len = 20;
r->rtm_src_len = 0;
r->rtm_table = RT_TABLE_MAIN;
r->rtm_type = RTN_UNICAST;
r->rtm_scope = RT_SCOPE_UNIVERSE;
r->rtm_protocol = rt->rt_protocol;
r->rtm_flags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtm_tos
(offset 3) is copied straight to user space on recvmsg(), leaking a
byte of uninitialised heap memory. This is in contrast to
mpls_dump_route(), which fills the very same header and does set
rtm_tos = 0.
Initialize rtm_tos to 0, matching mpls_dump_route().
Reproduced with KMSAN by adding an MPLS route and issuing a
non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0
_copy_to_iter+0x36c/0x33f0
__skb_datagram_iter+0x196/0x12c0
skb_copy_datagram_iter+0x5b/0x210
netlink_recvmsg+0x37b/0xef0
...
Uninit was created at:
__alloc_skb+0x8ca/0x10e0
mpls_getroute+0x1280/0x3a40
rtnetlink_rcv_msg+0x1138/0x15a0
...
Byte 19 of 64 is uninitialized
(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1
(git)
Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 466b474a8deb0c93b5280c6d261e5eda6482eca7 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < ba56f88aab18d982f2a21f11390f4d8a8897782a (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 95651461cf77cc6590fa08c87667717e5dcfa55d (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 1fea5ff0eb4aa7e951bb3d380248566c473aa377 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < a5cdd2407dd890f741f59b8367e4c6c101cce154 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 2dc2fffc704a4365cae1aae078ba62223aaeff93 (git) Affected: 397fc9e5cefee0c33b86811fbddb0decb7288c52 , < 295dd295e2137e10e9a5b1891d97e0f08de76f03 (git) |
|
| Linux | Linux |
Affected:
4.13
Unaffected: 0 , < 4.13 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mpls/af_mpls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "466b474a8deb0c93b5280c6d261e5eda6482eca7",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "ba56f88aab18d982f2a21f11390f4d8a8897782a",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "95651461cf77cc6590fa08c87667717e5dcfa55d",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "1fea5ff0eb4aa7e951bb3d380248566c473aa377",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "a5cdd2407dd890f741f59b8367e4c6c101cce154",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "2dc2fffc704a4365cae1aae078ba62223aaeff93",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
},
{
"lessThan": "295dd295e2137e10e9a5b1891d97e0f08de76f03",
"status": "affected",
"version": "397fc9e5cefee0c33b86811fbddb0decb7288c52",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mpls/af_mpls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: initialize rtm_tos in mpls_getroute()\n\nmpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE\nrequest by filling a struct rtmsg allocated from an skb whose data\narea is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every\nfield of the header except rtm_tos:\n\n\tr = nlmsg_data(nlh);\n\tr-\u003ertm_family\t = AF_MPLS;\n\tr-\u003ertm_dst_len\t= 20;\n\tr-\u003ertm_src_len\t= 0;\n\tr-\u003ertm_table\t= RT_TABLE_MAIN;\n\tr-\u003ertm_type\t= RTN_UNICAST;\n\tr-\u003ertm_scope\t= RT_SCOPE_UNIVERSE;\n\tr-\u003ertm_protocol = rt-\u003ert_protocol;\n\tr-\u003ertm_flags\t= 0;\n\nstruct rtmsg has no padding, so the one uninitialised byte rtm_tos\n(offset 3) is copied straight to user space on recvmsg(), leaking a\nbyte of uninitialised heap memory. This is in contrast to\nmpls_dump_route(), which fills the very same header and does set\nrtm_tos = 0.\n\nInitialize rtm_tos to 0, matching mpls_dump_route().\n\nReproduced with KMSAN by adding an MPLS route and issuing a\nnon-RTM_F_FIB_MATCH RTM_GETROUTE for its label:\n\n BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0\n _copy_to_iter+0x36c/0x33f0\n __skb_datagram_iter+0x196/0x12c0\n skb_copy_datagram_iter+0x5b/0x210\n netlink_recvmsg+0x37b/0xef0\n ...\n Uninit was created at:\n __alloc_skb+0x8ca/0x10e0\n mpls_getroute+0x1280/0x3a40\n rtnetlink_rcv_msg+0x1138/0x15a0\n ...\n Byte 19 of 64 is uninitialized\n\n(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:39:14.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1"
},
{
"url": "https://git.kernel.org/stable/c/466b474a8deb0c93b5280c6d261e5eda6482eca7"
},
{
"url": "https://git.kernel.org/stable/c/ba56f88aab18d982f2a21f11390f4d8a8897782a"
},
{
"url": "https://git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d"
},
{
"url": "https://git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377"
},
{
"url": "https://git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154"
},
{
"url": "https://git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93"
},
{
"url": "https://git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03"
}
],
"title": "net: mpls: initialize rtm_tos in mpls_getroute()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74577",
"datePublished": "2026-08-15T12:28:14.408Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-19T16:39:14.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74579 (GCVE-0-2026-74579)
Vulnerability from cvelistv5 – Published: 2026-08-17 05:28 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
netfilter: nft_payload: fix mask build for partial field offload
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload
expression that covers only part of a header field. For a partial IPv6
address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which
is undefined on the 32-bit int operand. It also trims only one word, so
the remaining words stay 0xffffffff (and when priv_len is a multiple of 4
the trim is skipped entirely), leaving the mask covering more bytes than
the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20
shift exponent 120 is too large for 32-bit type 'int'
...
The match is byte-granular and struct nft_data is zero-initialised, so the
correct mask is simply the first priv_len bytes set to 0xff. Set those
bytes directly and drop the word/shift trimming; this removes the undefined
shift and no longer over-masks the trailing bytes.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7
(git)
Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 8720df4504e0ed1781a702f65251bd47b3534d5e (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 363c3a84a946d53e5e121c9f47c7c2b7d228c46b (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < b19b5d2e042c294e2cc1c908dc598f9d64015396 (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < a375d8ace807767f29f276b681b6324c74929b1d (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 16b553c46e347bc9de9946c4960654d5884a86de (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 630295d5bba1d0e0f494cc459452eb0a0058c545 (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 39e88f28fb32bf02bd4b525c24c842c9cff5663d (git) Affected: 5c2b4b4f9fa5b765b927e361e3d310bcb5773015 (git) Affected: 5.9.14 , < 5.10 (semver) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "8720df4504e0ed1781a702f65251bd47b3534d5e",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "363c3a84a946d53e5e121c9f47c7c2b7d228c46b",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "b19b5d2e042c294e2cc1c908dc598f9d64015396",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "a375d8ace807767f29f276b681b6324c74929b1d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "16b553c46e347bc9de9946c4960654d5884a86de",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "630295d5bba1d0e0f494cc459452eb0a0058c545",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "39e88f28fb32bf02bd4b525c24c842c9cff5663d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"status": "affected",
"version": "5c2b4b4f9fa5b765b927e361e3d310bcb5773015",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field. For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 \u003c\u003c 120, which\nis undefined on the 32-bit int operand. It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n shift exponent 120 is too large for 32-bit type \u0027int\u0027\n ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only when installing nftables rules via NETLINK_NETFILTER (NFT_MSG_NEWRULE) on NFT_CHAIN_HW_OFFLOAD netdev ingress chains; nft_flow_rule_create() calls nft_payload_offload_mask() during expr offload setup, which is a local netlink syscall path per kernel CNA guidance for nftables/netfilter.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft a partial-field payload match (e.g., priv_len=1 on IPv6 saddr with field_len=16) on an HW-offload chain; no race, memory layout, or other conditions outside attacker control are required to hit the undefined shift and incorrect mask build.\nPR:L - All nf_tables netlink operations are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in nfnetlink_rcv(), checked against the socket network namespace user_ns; unprivileged local users routinely obtain CAP_NET_ADMIN via user+network namespaces (unshare -Urn) on cloud hosts and containers.\nUI:N - No victim interaction is required; the attacker installs the malformed HW-offload nftables rule through their own netlink socket and triggers the bug during rule commit without needing another user to mount filesystems, open files, or take any action.\nS:U - Impact is confined to the host kernel and its hardware-offloaded netdev ingress filtering policy (incorrect TC flower masks, potential kernel crash); this is standard kernel/network-authority impact, not a VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:N - The bug corrupts on-stack bitmask construction during rule installation and does not perform out-of-bounds reads, use-after-free, or other memory-disclosure primitives; no attacker-influenced kernel memory read path exists beyond incorrect mask values.\nI:H - Incorrect or UB-corrupted HW flower match masks misprogram NIC ingress ACLs on hardware-offloaded edge firewalls, causing accept/drop/redirect actions to apply to traffic contrary to administrator intent; this is exploitable integrity compromise of enforced network policy on internet-facing offload deployments.\nA:H - The undefined shift (1\u003c\u003c120) triggers documented UBSAN shift-out-of-bounds at rule install and can panic/oops on UBSAN/trap kernels; misprogrammed HW offload masks can also blackhole or mis-drop production ingress traffic on netdev-offloaded chains, satisfying CNA high availability guidance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:05.144Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7"
},
{
"url": "https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e"
},
{
"url": "https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b"
},
{
"url": "https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"
},
{
"url": "https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"
},
{
"url": "https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"
},
{
"url": "https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"
},
{
"url": "https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"
}
],
"title": "netfilter: nft_payload: fix mask build for partial field offload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74579",
"datePublished": "2026-08-17T05:28:27.768Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-08-25T05:40:05.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74580 (GCVE-0-2026-74580)
Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
vhost: reset the vring metadata cache on vring reconfiguration
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost: reset the vring metadata cache on vring reconfiguration
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < 5224bd37e37d36076a550d99b2aebba33939fd95
(git)
Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < 54617e9119be2eb728ecdd8d977b99c99d4c498a (git) Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < 13fa6f32a56a386a82bd7451644c494beed034af (git) Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7 (git) Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < 6fa3e9b1fe856259555a7e22f3f3082e7827fd9b (git) Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6 (git) Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < b70ebe0bba254e093dd5fd4c0c170941ce83eb85 (git) Affected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 , < de845981da67a6b049080c87e605130b0c30adc5 (git) |
|
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5224bd37e37d36076a550d99b2aebba33939fd95",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "54617e9119be2eb728ecdd8d977b99c99d4c498a",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "13fa6f32a56a386a82bd7451644c494beed034af",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "6fa3e9b1fe856259555a7e22f3f3082e7827fd9b",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "b70ebe0bba254e093dd5fd4c0c170941ce83eb85",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "de845981da67a6b049080c87e605130b0c30adc5",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq-\u003emeta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq-\u003edesc, vq-\u003eavail and vq-\u003eused, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time. Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap-\u003eaddr + addr - map-\u003estart\n\nfor an address the mapping no longer covers. vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()\u0027s slow path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires ioctl on /dev/vhost-net or /dev/vhost-vsock (VHOST_SET_OWNER, VHOST_SET_FEATURES with VIRTIO_F_ACCESS_PLATFORM, VHOST_SET_VRING_ADDR, IOTLB updates); although virtio kicks and network I/O trigger the corrupting copies, the stale-cache state is created only through local vhost character-device syscalls, not remote packets.\nAC:L - An attacker who controls the vhost owner process can deterministically populate meta_iotlb via normal virtqueue traffic, issue VHOST_SET_VRING_ADDR with new GIOVAs while the backend is live, then trigger descriptor/used-ring access; no races, special heap layout, or victim timing are required.\nPR:L - No host root is needed: exploitation is performed by the vhost device owner (standard libvirt/QEMU kvm-group account) or, in the highest-impact cloud scenario, an authorized malicious VM tenant whose virtio traffic drives vhost workers after QEMU updates live vring addresses under VIRTIO_F_ACCESS_PLATFORM.\nUI:N - No end-user or administrator action is required beyond routine automated VM operation (virtio I/O, vhost backend attachment, and vring setup) that the attacker or tenant controls directly.\nS:C - Stale IOTLB metadata translation makes the host kernel read/write outside the mapped vring regions in the VMM userspace address space (QEMU), crossing the guest-to-host virtualization boundary\u2014the same escape class as CVE-2025-38074, not mere in-guest kernel impact.\nC:H - vhost_copy_from_user and __vhost_get_user use vhost_vq_meta_fetch\u0027s stale map-\u003eaddr+addr-map-\u003estart translation without bounds checks, enabling out-of-bounds reads of adjacent VMM memory during descriptor and avail-ring fetches (arbitrary misdirected kernel reads from host userspace).\nI:H - vhost_copy_to_user and vhost_put_user write used-ring entries through the same stale translation, giving controlled out-of-bounds writes into the VMM process that can corrupt QEMU heap, IOTLB tables, or migration metadata for code-execution primitives.\nA:H - Misdirected __copy_to_user/__copy_from_user against unmapped or invalid VMM addresses can fault the vhost worker (host kernel oops/panic), and corrupting VMM control structures reliably crashes or kills the hypervisor process, terminating the VM."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:06.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95"
},
{
"url": "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a"
},
{
"url": "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af"
},
{
"url": "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7"
},
{
"url": "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b"
},
{
"url": "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6"
},
{
"url": "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85"
},
{
"url": "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5"
}
],
"title": "vhost: reset the vring metadata cache on vring reconfiguration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74580",
"datePublished": "2026-08-21T16:31:54.076Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:06.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74581 (GCVE-0-2026-74581)
Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
net: ipv6: clear suppressed fib6 rule result
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result
fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.
If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().
Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
209d35ee34e25f9668c404350a1c86d914c54ffa , < 90c57310e266eb94e4a80d6b15a9ca131d2e82cb
(git)
Affected: 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 , < 5d29b286c9de0b309e94b9ed083aa1a2f429434f (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 354db6243eca59e9d187ffbf8b7955b044ce84dc (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 9bad152c42b37499162367fe47867411e62fffa3 (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < dc3ab04220667f254f4348572b2a0b3febff89fb (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < a341c091ca0bfae377747b1b59a3bd8ebe18a937 (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 6aea62e433fe1b586202a5fee8b5807ce635e1d7 (git) Affected: ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29 (git) Affected: 5.10.84 , < 5.10.265 (semver) Affected: 5.15.7 , < 5.15.216 (semver) Affected: 5.4.164 , < 5.5 (semver) |
|
| Linux | Linux |
Affected:
5.16
Unaffected: 0 , < 5.16 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/fib6_rules.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb",
"status": "affected",
"version": "209d35ee34e25f9668c404350a1c86d914c54ffa",
"versionType": "git"
},
{
"lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f",
"status": "affected",
"version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383",
"versionType": "git"
},
{
"lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "9bad152c42b37499162367fe47867411e62fffa3",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"status": "affected",
"version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.84",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.7",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.164",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/fib6_rules.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.164",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res-\u003ert6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:07.594Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"
},
{
"url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"
},
{
"url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"
},
{
"url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"
},
{
"url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"
},
{
"url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"
},
{
"url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"
},
{
"url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"
}
],
"title": "net: ipv6: clear suppressed fib6 rule result",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74581",
"datePublished": "2026-08-21T16:31:54.683Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:07.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74582 (GCVE-0-2026-74582)
Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-27 12:39
VLAI
EPSS
VEX
Title
packet: use consistent hard_header_len in non-ring send paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in non-ring send paths
packet_snd() reads dev->hard_header_len multiple times while allocating
and constructing an skb. Device reconfiguration can change this value
concurrently, for example through bonding device type changes.
For SOCK_RAW, packet_snd() can save a larger value in reserve and later
allocate headroom using a smaller value. Moving skb->data back by reserve
then places it before skb->head, and the following copy from userspace can
attempt an out-of-bounds write.
packet_sendmsg_spkt() has the same issue because it calculates its
reservation and header offset from separate reads before dropping the RCU
read lock to allocate the skb.
Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.
Read hard_header_len once in packet_snd() and use it for allocation and
construction. In packet_sendmsg_spkt(), preserve the allocation-time value
through the device lookup retry.
The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812
(git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 78a47127e33c340bc6d38dcc4552a094b4f5cc77 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 142e287b3a25cfe909215177c23243e7fc5ae2b1 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 91f041451f967cd87ed722a8f43c0b767a64f1a0 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 9052756290962ffb9a661bcf319e92dedaaedfed (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 5bb10753d428aadfc356a2bfe9acea09c82a62ec (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < b06b6fce6d7deaf7238e09b48ce3b1125ff41acd (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 03390aa32e669cc4ecd7d34108e2e1afc13d689d (git) Affected: d9fb8cc230b2a4757e9fe4f81468f81212d4deaa (git) Affected: 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 (git) Affected: 01a658c1b9d4b5393c38d5a92d9112ab1425382a (git) Affected: 8809ae6747e760e6f1d2453ceb08c9bcc4939766 (git) Affected: 4.4.133 , < 4.5 (semver) Affected: 4.9.103 , < 4.10 (semver) Affected: 4.14.44 , < 4.15 (semver) Affected: 4.16.12 , < 4.17 (semver) |
|
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"status": "affected",
"version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
"versionType": "git"
},
{
"status": "affected",
"version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
"versionType": "git"
},
{
"status": "affected",
"version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
"versionType": "git"
},
{
"status": "affected",
"version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.133",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.103",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.44",
"versionType": "semver"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb-\u003edata before skb-\u003ehead, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:47.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812"
},
{
"url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77"
},
{
"url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1"
},
{
"url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
},
{
"url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
},
{
"url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
},
{
"url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
},
{
"url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
}
],
"title": "packet: use consistent hard_header_len in non-ring send paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74582",
"datePublished": "2026-08-21T16:31:55.283Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-27T12:39:47.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74583 (GCVE-0-2026-74583)
Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
net/sched: cls_route: fix fastmap use-after-free on filter
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_route: fix fastmap use-after-free on filter
The route4 classifier maintains a 16-slot fastmap cache that stores raw
struct route4_filter pointers indexed by (id, iif). The reader
(route4_classify) populates this cache via route4_set_fastmap() for every
classified packet that hits a filter. The writer (route4_delete,
route4_change) clears the cache via route4_reset_fastmap() before
RCU-deferred kfree of the filter.
This creates a UAF race:
1. Reader walks the RCU-protected bucket chain, finds filter f
2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()
3. Reader calls route4_set_fastmap() and writes f into the cache
*after* the writer's reset, caching a pointer about to be freed
4. After the RCU grace period, kfree(f) executes
5. Next classified packet on the same (id, iif) tuple hits the stale
fastmap entry and reads f->res from freed memory
Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a
concurrent add/delete stress test (provided by both zdi and Santosh).
Both triggered KASAN slab-use-after-free reports in the route4 fastmap
paths.
Fix:
Introduce a per-filter boolean dying flag to suppress stale fastmap
republishing by in-flight readers.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1109c00547fc66df45b9ff923544be4c1e1bec13 , < 7897198b26445b4009a057bda1986b94a99e5d5f
(git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 820f083c294ad6d319c02a7d43294f2ed2565139 (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 5ec9001be6d0eb527251125632ec8fe88278897f (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < b969984b2bdc85d721ce4047cd270cd37ec705a2 (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < a17f636c9330eac879822ce29f998e5abd1b72c1 (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 0e7a8cf8895b06d07c7311f028eba16ad742b9bc (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < ae9aff87025219005a2d16b4fe83d6f24643e50d (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 47d7f7051253bdc02b1d245d87e38f16d31a74df (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7897198b26445b4009a057bda1986b94a99e5d5f",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "820f083c294ad6d319c02a7d43294f2ed2565139",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "5ec9001be6d0eb527251125632ec8fe88278897f",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "b969984b2bdc85d721ce4047cd270cd37ec705a2",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "a17f636c9330eac879822ce29f998e5abd1b72c1",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "0e7a8cf8895b06d07c7311f028eba16ad742b9bc",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "ae9aff87025219005a2d16b4fe83d6f24643e50d",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "47d7f7051253bdc02b1d245d87e38f16d31a74df",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n *after* the writer\u0027s reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local rtnetlink RTM_NEWTFILTER/RTM_DELTFILTER (tc filter add/change/del route) through sendmsg\u2192rtnetlink_rcv_msg\u2192tc_new_tfilter/tc_del_tfilter\u2192route4_change/route4_delete; remote packets alone cannot trigger the filter-deletion side of the race.\nAC:L - The attacker controls both race sides\u2014concurrent route filter add/change/delete via netlink plus traffic through route4_classify on clsact/ingress/egress qdiscs; ZDI and independent reporter stress tests reproduced KASAN slab-use-after-free without uncontrollable prerequisites.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN), evaluated against the target network namespace user_ns; an unprivileged local user obtains CAP_NET_ADMIN via user+network namespaces (unshare -Urn) and configures clsact with route filters.\nUI:N - No victim interaction is needed; the attacker configures the route classifier, drives concurrent filter churn, and generates matching traffic from their own processes.\nS:U - Impact is kernel memory corruption within the same kernel security boundary (local privilege escalation/DoS); it does not cross VM, hypervisor, or IOMMU boundaries.\nC:H - Slab use-after-free: a stale fastmap entry retains a freed route4_filter pointer and route4_classify dereferences f-\u003eres from freed kmalloc memory; KASAN confirmed slab-use-after-free, enabling arbitrary kernel read via heap reclaim/spray.\nI:H - UAF of the kmalloc route4_filter object allows attacker-controlled heap spraying to reclaim the freed slot and obtain write/control-flow hijacking primitives; memory corruption is exploitable beyond a simple crash.\nA:H - UAF on the fastmap hot path causes kernel oops/panic under concurrent filter churn; KASAN slab-use-after-free was confirmed during add/delete stress testing, providing reliable denial of service even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:10.077Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f"
},
{
"url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139"
},
{
"url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f"
},
{
"url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2"
},
{
"url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1"
},
{
"url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc"
},
{
"url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d"
},
{
"url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df"
}
],
"title": "net/sched: cls_route: fix fastmap use-after-free on filter",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74583",
"datePublished": "2026-08-21T16:31:55.886Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:10.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74585 (GCVE-0-2026-74585)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-22 15:31
VLAI
EPSS
VEX
Title
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
tb_drom_parse_entry_port() validates the device-supplied header->index
against sw->config.max_port_number before indexing sw->ports[], but the
sibling field entry->dual_link_port_nr -- a 6-bit value also read from
the DROM -- indexes the same array with no such check. A malicious or
malformed Thunderbolt device can set dual_link_port_nr beyond the
allocated sw->ports[] (max_port_number + 1 entries), producing an
out-of-bounds tb_port pointer that is stored and later dereferenced.
Reject a port entry whose dual_link_port_nr exceeds max_port_number,
the same bound already applied to header->index.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < 6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c
(git)
Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < 3d3c212b70633332ab71672aa2bc6af257d2ec83 (git) Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < b98e1e28bd95b0fa33164eec1e763d26c7058b39 (git) Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < 50f0c8dd8c3390f851cfb97ca13116f9ee6469d1 (git) Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < f28066057134aa9294caa597b670daf505ad9dce (git) Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < 40d2ffb74094cf36edbe05855566a4c58b6ce808 (git) Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < f32c3a9a77cfb50934a60b05d5407649af062535 (git) Affected: cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6 , < d6764992f17b23d91ff93ce905ab53c2aa7191f0 (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/eeprom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "3d3c212b70633332ab71672aa2bc6af257d2ec83",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "b98e1e28bd95b0fa33164eec1e763d26c7058b39",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "50f0c8dd8c3390f851cfb97ca13116f9ee6469d1",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "f28066057134aa9294caa597b670daf505ad9dce",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "40d2ffb74094cf36edbe05855566a4c58b6ce808",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "f32c3a9a77cfb50934a60b05d5407649af062535",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
},
{
"lessThan": "d6764992f17b23d91ff93ce905ab53c2aa7191f0",
"status": "affected",
"version": "cd22e73bdf5eff7e68a0f8bdfbce123ad43651f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/eeprom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports\n\ntb_drom_parse_entry_port() validates the device-supplied header-\u003eindex\nagainst sw-\u003econfig.max_port_number before indexing sw-\u003eports[], but the\nsibling field entry-\u003edual_link_port_nr -- a 6-bit value also read from\nthe DROM -- indexes the same array with no such check. A malicious or\nmalformed Thunderbolt device can set dual_link_port_nr beyond the\nallocated sw-\u003eports[] (max_port_number + 1 entries), producing an\nout-of-bounds tb_port pointer that is stored and later dereferenced.\n\nReject a port entry whose dual_link_port_nr exceeds max_port_number,\nthe same bound already applied to header-\u003eindex."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:31:38.339Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c892ed9f4129ae40ef0f92e1bb31aa0b0ddc72c"
},
{
"url": "https://git.kernel.org/stable/c/3d3c212b70633332ab71672aa2bc6af257d2ec83"
},
{
"url": "https://git.kernel.org/stable/c/b98e1e28bd95b0fa33164eec1e763d26c7058b39"
},
{
"url": "https://git.kernel.org/stable/c/50f0c8dd8c3390f851cfb97ca13116f9ee6469d1"
},
{
"url": "https://git.kernel.org/stable/c/f28066057134aa9294caa597b670daf505ad9dce"
},
{
"url": "https://git.kernel.org/stable/c/40d2ffb74094cf36edbe05855566a4c58b6ce808"
},
{
"url": "https://git.kernel.org/stable/c/f32c3a9a77cfb50934a60b05d5407649af062535"
},
{
"url": "https://git.kernel.org/stable/c/d6764992f17b23d91ff93ce905ab53c2aa7191f0"
}
],
"title": "thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74585",
"datePublished": "2026-08-22T15:31:38.339Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-22T15:31:38.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74586 (GCVE-0-2026-74586)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
sctp: clear new_transport when removing a peer
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: clear new_transport when removing a peer
sctp_process_asconf_param() stores a newly added peer transport in
asoc->new_transport. After all parameters in the ASCONF chunk have been
processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the
new transport.
An authenticated ASCONF from a remote SCTP peer can add a transport and
remove it again with a wildcard DEL-IP parameter in the same chunk. The
wildcard deletion preserves the transport on which the ASCONF arrived, but
removes the newly added transport through
sctp_assoc_del_nonprimary_peers(). The removal does not clear
asoc->new_transport, leaving it pointing to the removed transport.
sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points
to the removed transport without holding a transport reference. During
local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on
control_chunk_list. After the transport is freed by RCU, a successful
ASCONF_ACK for the replacement address releases the queued HEARTBEAT and
sctp_outq_select_transport() reads the freed transport's state.
The issue was found during a static audit of SCTP objects. With an
authenticated peer, the reproducer triggered the same KASAN report in 2
of 2 unpatched runs on a KASAN-enabled netdev/main kernel:
BUG: KASAN: slab-use-after-free in sctp_outq_select_transport
Read of size 4 at addr ffff88800b9bd95c by task python3/197
Call Trace:
sctp_outq_select_transport+0x549/0x8b0 [sctp]
sctp_outq_flush+0x306/0x2c60 [sctp]
sctp_transport_immediate_rtx+0xaf/0x260 [sctp]
sctp_process_asconf_ack+0xa48/0xf70 [sctp]
Allocated by task 197:
sctp_transport_new+0x68/0x650 [sctp]
sctp_assoc_add_peer+0x258/0x12a0 [sctp]
sctp_process_asconf+0x5e9/0x1090 [sctp]
Last potentially related work creation:
__call_rcu_common.constprop.0+0x77/0xb70
sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]
sctp_process_asconf+0xd9c/0x1090 [sctp]
The first invalid access was a four-byte read of transport->state at
net/sctp/outqueue.c:833. The same reproducer completed the full
authenticated ASCONF and local-address replacement sequence with this
change without a KASAN report or oops.
Clear new_transport when its peer is removed, before it can be used to
create the HEARTBEAT.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < c0f973bb5118dd1b146cda3fcc8af6f6057befec
(git)
Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 3b539b317cd052236fed0350364ff1268996ba46 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < db9d8e3b670f841755bc2018f178472dc6064d27 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 31efa656cf6aface26e88f038c14f22ee6ca1500 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 291accf36febce751021888de5f15090f4875b56 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < ca33df36aa0143a1d04f57d2086020c12e7eddb7 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 163847552a571bd55094291f4ffcdc1de0f14a7b (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3 (git) |
|
| Linux | Linux |
Affected:
3.2
Unaffected: 0 , < 3.2 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0f973bb5118dd1b146cda3fcc8af6f6057befec",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "3b539b317cd052236fed0350364ff1268996ba46",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "db9d8e3b670f841755bc2018f178472dc6064d27",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "31efa656cf6aface26e88f038c14f22ee6ca1500",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "291accf36febce751021888de5f15090f4875b56",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "ca33df36aa0143a1d04f57d2086020c12e7eddb7",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "163847552a571bd55094291f4ffcdc1de0f14a7b",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear new_transport when removing a peer\n\nsctp_process_asconf_param() stores a newly added peer transport in\nasoc-\u003enew_transport. After all parameters in the ASCONF chunk have been\nprocessed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the\nnew transport.\n\nAn authenticated ASCONF from a remote SCTP peer can add a transport and\nremove it again with a wildcard DEL-IP parameter in the same chunk. The\nwildcard deletion preserves the transport on which the ASCONF arrived, but\nremoves the newly added transport through\nsctp_assoc_del_nonprimary_peers(). The removal does not clear\nasoc-\u003enew_transport, leaving it pointing to the removed transport.\n\nsctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u003etransport points\nto the removed transport without holding a transport reference. During\nlocal address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on\ncontrol_chunk_list. After the transport is freed by RCU, a successful\nASCONF_ACK for the replacement address releases the queued HEARTBEAT and\nsctp_outq_select_transport() reads the freed transport\u0027s state.\n\nThe issue was found during a static audit of SCTP objects. With an\nauthenticated peer, the reproducer triggered the same KASAN report in 2\nof 2 unpatched runs on a KASAN-enabled netdev/main kernel:\n\n BUG: KASAN: slab-use-after-free in sctp_outq_select_transport\n Read of size 4 at addr ffff88800b9bd95c by task python3/197\n\n Call Trace:\n sctp_outq_select_transport+0x549/0x8b0 [sctp]\n sctp_outq_flush+0x306/0x2c60 [sctp]\n sctp_transport_immediate_rtx+0xaf/0x260 [sctp]\n sctp_process_asconf_ack+0xa48/0xf70 [sctp]\n\n Allocated by task 197:\n sctp_transport_new+0x68/0x650 [sctp]\n sctp_assoc_add_peer+0x258/0x12a0 [sctp]\n sctp_process_asconf+0x5e9/0x1090 [sctp]\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0+0x77/0xb70\n sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]\n sctp_process_asconf+0xd9c/0x1090 [sctp]\n\nThe first invalid access was a four-byte read of transport-\u003estate at\nnet/sctp/outqueue.c:833. The same reproducer completed the full\nauthenticated ASCONF and local-address replacement sequence with this\nchange without a KASAN report or oops.\n\nClear new_transport when its peer is removed, before it can be used to\ncreate the HEARTBEAT."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered when a remote SCTP peer sends an authenticated ASCONF chunk that is processed via sctp_rcv() through the state machine into sctp_sf_do_asconf() and sctp_process_asconf(); this is standard network packet handling, not a local syscall or ioctl path.\nAC:L - The remote peer fully controls a single ASCONF containing ADD_IP followed by wildcard DEL-IP to add then remove a transport while leaving asoc-\u003enew_transport dangling; combined with routine SCTP local address replacement (src_out_of_asoc_ok), the KASAN reproducer hit the UAF in 2/2 runs.\nPR:N - Exploitation requires only being an established SCTP association peer sending SCTP-AUTH-protected ASCONF traffic negotiated during the normal handshake (or addip_noauth); no Linux account, capability, or init-namespace privilege is needed on the victim host.\nUI:N - No victim user action such as opening a file or mounting a filesystem is required; the kernel automatically processes attacker-crafted ASCONF packets on an existing SCTP association during normal server operation.\nS:U - Impact is confined to kernel heap corruption on the vulnerable host (slab UAF on sctp_transport) and potential privilege escalation within that kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - KASAN reports slab-use-after-free with a 4-byte read of freed sctp_transport-\u003estate in sctp_outq_select_transport(); UAF on heap transport objects enables grooming for arbitrary kernel memory disclosure per kernel CVSS guidance.\nI:H - The dangling sctp_transport pointer is embedded in a queued HEARTBEAT control chunk without a reference; UAF on this heap object can be leveraged via heap spraying for arbitrary kernel writes and control-flow hijacking, not merely a bounded corruption.\nA:H - Dereferencing the freed transport during sctp_outq_flush() causes a reproducible kernel UAF/oops; remote peers can repeatedly trigger this against SCTP endpoints handling ADD-IP traffic, yielding denial of service or crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:12.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0f973bb5118dd1b146cda3fcc8af6f6057befec"
},
{
"url": "https://git.kernel.org/stable/c/3b539b317cd052236fed0350364ff1268996ba46"
},
{
"url": "https://git.kernel.org/stable/c/db9d8e3b670f841755bc2018f178472dc6064d27"
},
{
"url": "https://git.kernel.org/stable/c/31efa656cf6aface26e88f038c14f22ee6ca1500"
},
{
"url": "https://git.kernel.org/stable/c/291accf36febce751021888de5f15090f4875b56"
},
{
"url": "https://git.kernel.org/stable/c/ca33df36aa0143a1d04f57d2086020c12e7eddb7"
},
{
"url": "https://git.kernel.org/stable/c/163847552a571bd55094291f4ffcdc1de0f14a7b"
},
{
"url": "https://git.kernel.org/stable/c/beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3"
}
],
"title": "sctp: clear new_transport when removing a peer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74586",
"datePublished": "2026-08-22T15:31:39.094Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:12.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74587 (GCVE-0-2026-74587)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
sctp: fix use-after-free of cached ASCONF chunk
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix use-after-free of cached ASCONF chunk
addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal
ASCONF-ACK completion path releases the chunk and clears the pointer.
However, sctp_asconf_queue_teardown() releases the cached chunk without
clearing addip_last_asconf. During peer restart handling,
sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes
sctp_asconf_queue_teardown() while the association remains alive and leaves
the pointer dangling.
A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),
which accesses the stale chunk and passes it to sctp_process_asconf_ack(),
causing a use-after-free and a second release.
Clearing the pointer exposes a race with T4 expiry. Peer restart handling
queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses
timer_delete(), which does not wait for a callback already running on
another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after
the purge and dereference NULL.
Clear addip_last_asconf after releasing the cached chunk, and make
sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding
ASCONF remains.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a000c01e60e40e15304ffe48fff051d17a7bea91 , < 10459b03e2d9ee12435e96f587de4d4cacdbf435
(git)
Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < e1bb114e09372fd6e03387ced9ef566da336ed6c (git) Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < 179676f0166230c80053a392303485b37c93dd33 (git) Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d (git) Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < 618b5c6d049896fcfabb91afc072954c92cb2693 (git) Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < 07daf4f9750104960a1d60831b2353c0d41f35fb (git) Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < d949992bc3f00027a2c755e860a11950c75f6073 (git) Affected: a000c01e60e40e15304ffe48fff051d17a7bea91 , < 8c283e7b56adce00193837f3311b06662466fb21 (git) |
|
| Linux | Linux |
Affected:
3.0
Unaffected: 0 , < 3.0 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c",
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10459b03e2d9ee12435e96f587de4d4cacdbf435",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "e1bb114e09372fd6e03387ced9ef566da336ed6c",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "179676f0166230c80053a392303485b37c93dd33",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "618b5c6d049896fcfabb91afc072954c92cb2693",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "07daf4f9750104960a1d60831b2353c0d41f35fb",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "d949992bc3f00027a2c755e860a11950c75f6073",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
},
{
"lessThan": "8c283e7b56adce00193837f3311b06662466fb21",
"status": "affected",
"version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c",
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The UAF is triggered when the kernel processes inbound SCTP COOKIE-ECHO (peer restart) and ASCONF-ACK chunks from a remote association peer via sctp_rcv()/sctp_inq_push()/sctp_do_sm(), with no local syscall required on the victim.\nAC:L - The remote SCTP peer controls the full protocol sequence\u2014establishing an ADDIP-capable association, waiting for the victim\u0027s outstanding ASCONF, sending COOKIE-ECHO restart to purge queues, then delivering a delayed authenticated ASCONF-ACK\u2014without attacker-uncontrollable races or memory layout.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted COOKIE-ECHO and ASCONF-ACK packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - sctp_sf_do_asconf_ack() and sctp_process_asconf_ack() dereference the stale addip_last_asconf pointer to read freed sctp_chunk and skb metadata; UAF on slab-allocated chunk objects enables heap grooming for arbitrary kernel memory disclosure.\nI:H - The stale pointer causes sctp_process_asconf_ack() to perform a second sctp_chunk_free() on an already-freed chunk, yielding a kmem_cache double-free that can be leveraged for arbitrary kernel write or control-flow hijack.\nA:H - Dereferencing the freed cached ASCONF chunk during ASCONF-ACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:13.798Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435"
},
{
"url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c"
},
{
"url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33"
},
{
"url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d"
},
{
"url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693"
},
{
"url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb"
},
{
"url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073"
},
{
"url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21"
}
],
"title": "sctp: fix use-after-free of cached ASCONF chunk",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74587",
"datePublished": "2026-08-22T15:31:39.810Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:13.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74588 (GCVE-0-2026-74588)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-08-25 05:40
VLAI
EPSS
VEX
Title
sctp: keep chunk->transport in step with the list it is queued on
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: keep chunk->transport in step with the list it is queued on
__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's
transmitted list without updating chunk->transport:
if (chunk->tsn_gap_acked) {
list_move_tail(&chunk->transmitted_list,
&transport->transmitted);
continue;
}
The chunk then sits on a live transport's list while chunk->transport still
names a different one. If that transport is removed - sctp_assoc_rm_peer()
from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk
is left with a dangling pointer. sctp_assoc_rm_peer() scrubs
peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on
neither.
The pointer is not followed while tsn_gap_acked is set. A SACK that
reneges on the TSN clears the flag, and the next SACK reaches
tchunk->transport->flight_size -= sctp_data_size(tchunk);
inside the freed transport. KASAN reports a slab-use-after-free read in
sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the
removal and the SACKs come from the association peer.
Set chunk->transport at the move. The ordinary resend path needs nothing:
it reaches its list_move_tail() only after sctp_packet_append_chunk()
returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the
chunk by then.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6575fb17230814b48b471727c8410c0aadff9274
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6b9e2ea2057113f3393990ba646d2d97c719a80d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 874a7c2b5e184f06134fdfde27e9ce9271bafe58 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1adf929121e13e0b19200bb9fef715b918d483fe (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e2e7c1de0e226ca1b7fea2de57a6c9bca408709b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9f2cf069a9a72a2d6b97ca8b4c70e714aac99749 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/outqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6575fb17230814b48b471727c8410c0aadff9274",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6b9e2ea2057113f3393990ba646d2d97c719a80d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "874a7c2b5e184f06134fdfde27e9ce9271bafe58",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1adf929121e13e0b19200bb9fef715b918d483fe",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e2e7c1de0e226ca1b7fea2de57a6c9bca408709b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9f2cf069a9a72a2d6b97ca8b4c70e714aac99749",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/outqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk-\u003etransport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport\u0027s\ntransmitted list without updating chunk-\u003etransport:\n\n\tif (chunk-\u003etsn_gap_acked) {\n\t\tlist_move_tail(\u0026chunk-\u003etransmitted_list,\n\t\t\t \u0026transport-\u003etransmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport\u0027s list while chunk-\u003etransport still\nnames a different one. If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer. sctp_assoc_rm_peer() scrubs\npeer-\u003etransmitted and asoc-\u003eoutqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set. A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk-\u003etransport-\u003eflight_size -= sctp_data_size(tchunk);\n\ninside the freed transport. KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk-\u003etransport at the move. The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when the kernel SCTP stack processes inbound SACK and ASCONF chunks from a remote association peer via sctp_rcv()/sctp_inq_push(), with no local syscall or ioctl required on the victim.\nAC:L - The remote peer controls the SCTP protocol sequence (gap SACKs, ADDIP multihoming, ASCONF Delete-IP, and SACK reneging) needed to strand a chunk and free its transport; no attacker-uncontrollable race or rare memory layout is required.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted SACK and ASCONF packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - KASAN reports a slab use-after-free read through dangling chunk-\u003etransport in sctp_check_transmitted(); UAF on sctp_transport objects can be groomed for arbitrary kernel memory disclosure.\nI:H - The UAF dereference performs flight_size arithmetic on a freed sctp_transport slab object, enabling heap grooming and arbitrary kernel write or control-flow hijack primitives typical of SCTP transport UAFs.\nA:H - Accessing freed transport memory during SACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:15.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274"
},
{
"url": "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d"
},
{
"url": "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58"
},
{
"url": "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe"
},
{
"url": "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b"
},
{
"url": "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d"
},
{
"url": "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b"
},
{
"url": "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749"
}
],
"title": "sctp: keep chunk-\u003etransport in step with the list it is queued on",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74588",
"datePublished": "2026-08-22T15:31:40.466Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:15.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…