{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "79ffa99202c944467e28b13b513bf2998732edff",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "37c61b3745129cbd682c557b51345828120972e5",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "75eec935444db4af2123e0491936f6e273d7ea00",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:24.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"
        },
        {
          "url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"
        },
        {
          "url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"
        }
      ],
      "title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74669",
    "datePublished": "2026-08-22T15:32:40.221Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-08-25T05:41:24.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_est.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5122a2b2601145975d387006e517c56896e310e",
              "status": "affected",
              "version": "705dd34440812735ece298eb5bc153fde9544d42",
              "versionType": "git"
            },
            {
              "lessThan": "de98dc5ef94b83bbb444c670c253ea02ca0f5e43",
              "status": "affected",
              "version": "705dd34440812735ece298eb5bc153fde9544d42",
              "versionType": "git"
            },
            {
              "lessThan": "e7f34f29b330265d456943bf0b984dcecfcef9af",
              "status": "affected",
              "version": "705dd34440812735ece298eb5bc153fde9544d42",
              "versionType": "git"
            },
            {
              "lessThan": "2335dedc1922dfa889ca1f9f70370924e8e79a08",
              "status": "affected",
              "version": "705dd34440812735ece298eb5bc153fde9544d42",
              "versionType": "git"
            },
            {
              "lessThan": "558f67f1340f803a346ecd14a69c49653111c5f4",
              "status": "affected",
              "version": "705dd34440812735ece298eb5bc153fde9544d42",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_est.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: stop estimator after disabled calc phase\n\nIPVS estimator kthread 0 starts with zeroed chain and tick limits until\nits initial calculation phase completes. If network namespace teardown\nclears ipvs-\u003eenable during that phase, ip_vs_est_calc_phase() can return\nwithout installing positive limits.\n\nThe kthread can then continue into its main loop and drain\nest_temp_list with zero chain_max, tick_max and est_max_count values.\nEach enqueue consumes one available tick row, but est_count never\nreaches the zero est_max_count value. After all rows are consumed, the\nrow lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes\npast the ticks and tick_len arrays.\n\nExit kthread 0 after the calculation phase if the kthread is stopping or\nIPVS has been disabled. That keeps temporary estimators from being\ndrained after the limits failed to initialize.\n\nEstimator kthreads can now self-exit before teardown or reload stops\nkd-\u003etask. Keep an extra task reference after creation and release it\nwith kthread_stop_put(), so kd-\u003etask remains valid until the stop paths\nconsume that reference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local IPVS configuration via netlink or setsockopt (GENL_ADMIN_PERM/CAP_NET_ADMIN); the bug is in estimator kthread management during namespace teardown, not in remote packet handling.\nAC:L - The attacker controls both sides of the race by creating a network namespace, adding many IPVS services to populate est_temp_list, and tearing down the namespace during kthread 0\u0027s calc phase.\nPR:L - Triggering IPVS service creation and namespace teardown requires CAP_NET_ADMIN, which unprivileged users can obtain in user+network namespaces via unshare on systems with unprivileged user namespaces enabled.\nUI:N - No victim interaction is required; an attacker can script IPVS service creation and namespace destruction without any action from another user or administrator.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same kernel security boundary; impact is local privilege escalation or denial of service, not a cross-boundary escape.\nC:H - Out-of-bounds writes past ticks[] and tick_len[] corrupt adjacent heap metadata and kernel structures, providing a memory corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Writing past the fixed-size ticks[] and tick_len[] arrays enables heap corruption that can overwrite function pointers or adjacent objects, supporting arbitrary kernel write and potential code execution.\nA:H - Heap corruption from unbounded index writes in ip_vs_enqueue_estimator() can cause kernel oops, panic, or hang when processing estimators after failed calc-phase initialization."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:25.343Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5122a2b2601145975d387006e517c56896e310e"
        },
        {
          "url": "https://git.kernel.org/stable/c/de98dc5ef94b83bbb444c670c253ea02ca0f5e43"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7f34f29b330265d456943bf0b984dcecfcef9af"
        },
        {
          "url": "https://git.kernel.org/stable/c/2335dedc1922dfa889ca1f9f70370924e8e79a08"
        },
        {
          "url": "https://git.kernel.org/stable/c/558f67f1340f803a346ecd14a69c49653111c5f4"
        }
      ],
      "title": "ipvs: stop estimator after disabled calc phase",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74670",
    "datePublished": "2026-08-22T15:32:40.850Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:25.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_appraise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d823b5f4557083d1dd92096f796a78a2b1b06d10",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "caeb105c15ea2431fa8da7ecfa242d0c68272426",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "a784b4732ac7e51862b9b210c2d8b2ab9e83568c",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "b6cb134707a2127d90a58d69dd818679cae8033c",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "7e515b6c9aab452a4f0734bd7208e4e780e164ca",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "27f3924061592d0ef6b04e16f48754b6cb6adf27",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "dd04114af0d451091f7b8cbd26d9e37d011e9131",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            },
            {
              "lessThan": "5ff232d31106f45ac87c3b64e1d35a0667777797",
              "status": "affected",
              "version": "3ea7a56067e663278470c04fd655adf809e72d4d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_appraise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: fix out-of-bounds read in xattr_verify()\n\nThe digest-length check in xattr_verify() mixes int and size_t:\n\n\tif (xattr_len - sizeof(xattr_value-\u003etype) - hash_start \u003e=\n\t\t\tiint-\u003eima_hash-\u003elength)\n\nsizeof() yields size_t, so the usual arithmetic conversions promote\nthe whole left-hand side to unsigned 64-bit before the subtraction\nruns. For a truncated xattr this underflows instead of going negative:\na 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1)\nturns \"1 - 1 - 1\" into SIZE_MAX, which is trivially \u003e= ima_hash-\u003elength.\nThe check then passes and the following memcmp() reads\niint-\u003eima_hash-\u003elength bytes starting past the end of the buffer\nvfs_getxattr_alloc() allocated for it.\n\nNothing upstream clamps xattr_len back into a safe range first:\nima_get_hash_algo() only special-cases xattr_len \u003c 2 to pick a default\nalgorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than\nfailing when no HMAC key is loaded, so a truncated security.ima value\nreaches the length check as-is.\n\nRewrite the comparison so every operand stays a signed int and no\nimplicit conversion to size_t can occur."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:41.480Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d823b5f4557083d1dd92096f796a78a2b1b06d10"
        },
        {
          "url": "https://git.kernel.org/stable/c/caeb105c15ea2431fa8da7ecfa242d0c68272426"
        },
        {
          "url": "https://git.kernel.org/stable/c/a784b4732ac7e51862b9b210c2d8b2ab9e83568c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6cb134707a2127d90a58d69dd818679cae8033c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e515b6c9aab452a4f0734bd7208e4e780e164ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/27f3924061592d0ef6b04e16f48754b6cb6adf27"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd04114af0d451091f7b8cbd26d9e37d011e9131"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ff232d31106f45ac87c3b64e1d35a0667777797"
        }
      ],
      "title": "ima: fix out-of-bounds read in xattr_verify()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74671",
    "datePublished": "2026-08-22T15:32:41.480Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:41.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mmap_lock.h",
            "mm/pagewalk.c",
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39c6772b56a6bbdd62794833f74232971d94d7c9",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "8d7f560f4b0482d469de962fbe4b59c37561052e",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "c5bf8cd148cfea948cfa3db71da427294b20db0f",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "3cc26c8907db0f5d1ff8043b5851ee572e9b3c98",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "26444eb71465c9934d9d418ef69c43f61185329b",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "31895cfd79564111cdd5a9f48c5d491ae26a238e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c7f7bdb1932f8c1e5f80d32c717184701afe701",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "acdb4981644c8e31ccee294bdefff475c0cf587b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0454e2fad9306961540ee7e84da47a8e345b7d22",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.125",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.91",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.31",
              "versionType": "semver"
            },
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "4.15.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mmap_lock.h",
            "mm/pagewalk.c",
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.15.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF\n\nPatch series \"mm: fix UAF caused by race between ptdump and vmap pgtable\nfreeing\", v6.\n\nKernel page table walkers fall into two broad categories - those ranges\nwhere no exclusion is required via walk_kernel_page_table_range_lockless()\nand those where exclusion is required via walk_kernel_page_table_range()\nor walk_page_range_debug().\n\nThe former category is used only by arm64 arch code operating on ranges it\nboth wholly owns and does not concurrently write.\n\nThe latter category consists of kernel page table walkers operating on\nranges that are wholly owned (but which need exclusion against concurrent\nwriters).\n\nThe lock used for exclusion is the mmap lock, and for kernel ranges this\nis the mmap lock on init_mm.\n\nptdump is a special case being both the only user of\nwalk_page_range_debug(), and the only case in which it walks ranges it\ndoes not own.\n\nThis presents a problem, as page tables may be freed under ptdump.  And\nindeed there is a use-after-free bug in the kernel as a result, which this\nseries addresses.\n\nvmap promotes page tables to huge leaf entries where possible, freeing the\nlower page table when it does.  It does this with no meaningful locks held\nagainst concurrent ptdump walks.\n\nAs a result, use-after-free can currently occur.  This series addresses\nthe issue by having the vmap huge promotion logic acquire the mmap read\nlock while both setting the huge page table entry and freeing the prior\nleaf page table.\n\nThe ptdump code already acquires the mmap write lock, so by doing so we\nensure that the ptdump walker only ever observes either the huge page\ntable entry or the existing page table entry, and nothing is freed\nunderneath it.\n\nA mitigation for this issue was already applied for arm64 in commit\nfa93b45fd397 (\"arm64: Enable vmalloc-huge with ptdump\"), which this series\nhas to deal with carefully.\n\nThis mitigation resolves the issue by acquiring the mmap read lock on\ninit_mm on vmap page table free if a ptdump is in progress.\n\nHowever the fix in this series would cause a deadlock if we were to simply\napply it for arm64 without also reverting the change.\n\nThis is because vmap may acquire the read lock before ptdump attempts to\nacquire the write lock, which then gets queued, and rwsem starvation rules\nmean that the (unacknowledged) nested mmap read lock in the arm64 code\nwould also block, meaning the original read lock is never released and\nthus deadlock.\n\nThis series works around this by #ifndef CONFIG_ARM64\u0027ing the mmap read\nlock in vmap logic, then partially reverting commit fa93b45fd397 (\"arm64:\nEnable vmalloc-huge with ptdump\"), keeping the enablement of huge vmap\nsupport, and removing the ifdeffery with the partial revert patch.\n\nThere are related issues that are also addressed in this series:\n\n* x86 page attribute logic, specifically Change Page Attributes (CPA),\n  implements a feature whereby huge ranges can be collapsed into huge leaf\n  entries. This can similarly cause a UAF when done in parallel with a\n  ptdump walk, so similarly acquire the init_mm mmap lock to avoid this.\n\n* The CPA logic allows concurrent page table manipulation and CPA\n  collapse, meaning the former risks accessing a page table the latter\n  frees. Fix this by acquiring mmap write lock on init_mm across the\n  whole CPA collapse operation and read lock on the page table\n  manipulation.\n\n* x86 and arm64 permit walks of non-kernel mm\u0027s (both allowing efi mm\n  walks, and in x86\u0027s case arbitrary mm\u0027s), so we ensure kernel mappings\n  remain stable by locking the init_mm as well as the mm being walked.\n\nThe ordering of patches is established for both strict dependencies (the\narm64 partial revert in particular has to be done after the vmap changes)\nand logical ones (the non-kernel mm fix only makes sense once the vmap/CPA\nfixes are in place).\n\n\nThis patch (of 3):\n\nCurrently there is a nasty ra\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:58.392Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39c6772b56a6bbdd62794833f74232971d94d7c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d7f560f4b0482d469de962fbe4b59c37561052e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5bf8cd148cfea948cfa3db71da427294b20db0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cc26c8907db0f5d1ff8043b5851ee572e9b3c98"
        },
        {
          "url": "https://git.kernel.org/stable/c/26444eb71465c9934d9d418ef69c43f61185329b"
        }
      ],
      "title": "mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74672",
    "datePublished": "2026-08-22T15:32:42.210Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-23T12:47:58.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/evdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2e3839419ac4047835762c4d7712bda1101b57e",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "c6d5fa46c1ee25d068fc730fd377f0f54188d290",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "e748811d9b80a3e101110ff4b3c612e5fca54d98",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "06a286b320236508d02ab2ccc9496352748652a8",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "bd3c4108a56de34380edab670065e86283cb3029",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "7e55ca1080f09d9f7112c7f20ac31f682c1f2374",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "90f305f2c7a30257c683e13f4bf7c798eea992a0",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/evdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - fix information leak in evdev_pass_values()\n\nIn evdev_pass_values(), the input_event structure is allocated on the\nkernel stack and populated field-by-field. However, it is never fully\ninitialized. On architectures where struct input_event contains explicit\nor implicit padding (such as the 32-bit __pad field on SPARC64), these\npadding bytes are left uninitialized.\n\nWhen this event structure is subsequently passed to the client buffer\nand later copied to userspace, the uninitialized padding bytes leak\nkernel stack memory, potentially exposing sensitive information.\n\nSimilar issues exist in __evdev_queue_syn_dropped and __pass_event.\n\nFix this by explicitly zeroing the entire event structure with memset()\nbefore populating its fields. This ensures all padding bytes are cleared\nbefore the data crosses the security boundary."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:23:15.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2e3839419ac4047835762c4d7712bda1101b57e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6d5fa46c1ee25d068fc730fd377f0f54188d290"
        },
        {
          "url": "https://git.kernel.org/stable/c/e748811d9b80a3e101110ff4b3c612e5fca54d98"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a286b320236508d02ab2ccc9496352748652a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd3c4108a56de34380edab670065e86283cb3029"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e55ca1080f09d9f7112c7f20ac31f682c1f2374"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f305f2c7a30257c683e13f4bf7c798eea992a0"
        }
      ],
      "title": "Input: evdev - fix information leak in evdev_pass_values()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74673",
    "datePublished": "2026-08-22T15:32:42.941Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:23:15.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/keyboard.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b84fd400f80adf4d1c88fbce50ae1cf2f8119e65",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "38400673c9bfb39cfc87539e1a072087e98f4e4f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cab5a342f0589334046741006d8a280514f94235",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "38a0aa593ebc275aea6f79534d07f44e43768ce6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3f6b1d3fcfc26dc3fc85262f753439df93b055b4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b664592e9ba8c47c9e23408db7ba52eb9f946c8a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cc4a1a2ce0c58eafd477effb055863935260ddc1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e25d47a526939ad44b75f778b8a7500562b84fc1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/keyboard.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: stabilize tty reference in kbd_keycode with tty_port_tty_get\n\nkbd_keycode() reads vc-\u003eport.tty without acquiring a tty reference,\nracing against con_shutdown() which clears port.tty under a different\nlock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference\nfor the duration the tty pointer is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local virtual-console and input paths: kbd_keycode runs from the VT keyboard input handler on key/key-repeat events while con_shutdown runs during final close(2) on /dev/ttyN; there is no network, Bluetooth-only, or remote-protocol reachability to both sides of the race.\nAC:L - The attacker controls both race participants: one thread can loop open/close a console tty to drive release_tty/con_shutdown while another holds a key for repeat events (down==2) or injects EV_KEY via uinput, retrying until kbd_keycode uses a freed tty_struct.\nPR:L - No real-root capability is required; a console-logged-in user with normal DAC access to /dev/ttyN (typical tty-group membership) can close their VT tty and generate foreground key events, and vt_ioctl grants perm to the controlling-tty owner without CAP_SYS_TTY_CONFIG.\nUI:N - The attacker performs every step from its own console session\u2014opening/closing the VT tty and generating key or key-repeat input\u2014so no separate victim or administrator action is required.\nS:U - The slab use-after-free corrupts kernel heap memory within the same kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After the tty is freed, kbd_keycode reads freed tty_struct fields (termios for L_ECHO and optionally tty-\u003eops via tty_chars_in_buffer), giving a use-after-free read primitive and enabling disclosure of kernel memory once the slab object is reclaimed.\nI:H - The path writes tty-\u003edriver_data on a freed tty_struct and may indirect-call through tty-\u003eops in tty_chars_in_buffer, enabling heap spray and control-flow hijack for arbitrary kernel modification or privilege escalation.\nA:H - Use-after-free on tty_struct reliably produces kernel oops or panic on illegal dereference through freed memory, and the open/close versus key-repeat race can be retriggered at will for repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:27.811Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b84fd400f80adf4d1c88fbce50ae1cf2f8119e65"
        },
        {
          "url": "https://git.kernel.org/stable/c/38400673c9bfb39cfc87539e1a072087e98f4e4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cab5a342f0589334046741006d8a280514f94235"
        },
        {
          "url": "https://git.kernel.org/stable/c/38a0aa593ebc275aea6f79534d07f44e43768ce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6b1d3fcfc26dc3fc85262f753439df93b055b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b664592e9ba8c47c9e23408db7ba52eb9f946c8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc4a1a2ce0c58eafd477effb055863935260ddc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e25d47a526939ad44b75f778b8a7500562b84fc1"
        }
      ],
      "title": "vt: stabilize tty reference in kbd_keycode with tty_port_tty_get",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74675",
    "datePublished": "2026-08-22T15:32:44.493Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:27.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/vt_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9f8cbaf4b774694dcc292e60509762483ebfd9ae",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ddc4a8303347114e945b9e6e81b81d77855f7358",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1c5b67a1e2cb7d78dab321280f330b056e3bf437",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d8ead5083b203d12b8319e7cb29cc6b8836e813f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4671c3b79e337bbae28c2d79023dc642df012bde",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a1c31e026c93e378e297a8df8328983d3013a59f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7bf32337a7103ccb686cbd240324bf26225ef2d6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a7ad0034453ba4c353f9b8f810ee2569de33d283",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/vt_ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: add permission check for KDSKBMETA ioctl\n\nKDSKBMETA modifies keyboard meta mode but lacks the !perm check that all\nother keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process\nto change meta mode on a non-controlling console without authorization."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:23:18.083Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9f8cbaf4b774694dcc292e60509762483ebfd9ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddc4a8303347114e945b9e6e81b81d77855f7358"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c5b67a1e2cb7d78dab321280f330b056e3bf437"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8ead5083b203d12b8319e7cb29cc6b8836e813f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4671c3b79e337bbae28c2d79023dc642df012bde"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1c31e026c93e378e297a8df8328983d3013a59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bf32337a7103ccb686cbd240324bf26225ef2d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7ad0034453ba4c353f9b8f810ee2569de33d283"
        }
      ],
      "title": "vt: add permission check for KDSKBMETA ioctl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74676",
    "datePublished": "2026-08-22T15:32:45.256Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:23:18.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ipheth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d07133fe1befae9a1e4c4c5e46ef0b73d2992020",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "48303f3ae0fa6e102f3fc7dbf1688cc179131962",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "fde39b8a521780391fb4e5bda2c0aa4928947f12",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2df9fd07698bece3321fbf9e4b6dbcb9babccc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea7d6be58c2e6c1f426b48994bb22b2393c90963",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5bca75dc46701f4c0d1dcbaae401233ae7ff06b",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.180",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.173",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.116",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ipheth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.173",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.116",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ipheth: fix carrier_work UAF on disconnect\n\nipheth_sndbulk_callback() re-arms the carrier-check work on any\nnon-zero URB status:\n\n\telse\n\t\tschedule_delayed_work(\u0026dev-\u003ecarrier_work, 0);\n\nNothing ties that to the interface being up, so the work can be armed\nagain after ipheth_close() has already drained it, and stay armed\nuntil the netdev whose private area embeds it is freed.\n\nOn unplug with a TX URB in flight, ipheth_disconnect() drains the work\nthrough unregister_netdev() -\u003e ipheth_close() -\u003e\ncancel_delayed_work_sync() and only then calls ipheth_kill_urbs().\nusb_kill_urb() completes the in-flight TX URB with -ENOENT, so\nipheth_sndbulk_callback() runs after the drain and re-arms\ncarrier_work.\n\nThe same completion also re-arms the work if the interface is only\nbrought down while a TX URB is in flight, and\nipheth_carrier_check_work() then keeps re-queueing itself once a\nsecond. unregister_netdev() does not call ipheth_close() for an\nalready-down interface, so nothing drains it on the later unplug\neither.\n\nIn both cases free_netdev() frees the netdev while carrier_work is\nstill pending, and ipheth_carrier_check_work() dereferences freed\nmemory.\n\nTie the work to the interface state instead of chasing the completion:\ndisable it in ipheth_close() and enable it in ipheth_open(), so a\nschedule_delayed_work() from the URB completion is a no-op whenever\nthe interface is not up. disable_delayed_work_sync() also waits for a\nrunning instance, so it fully replaces the cancel_delayed_work_sync()\nit takes the place of. The work starts out disabled in ipheth_probe()\nso the enable/disable counts balance from the first open.\n\nReproduced under KASAN on linux-next (next-20260731) with dummy_hcd and\nraw-gadget standing in for the device, driving the second path above (the\ninterface is already down, so unregister_netdev() does not call\nipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in\n__run_timers(), freed by ipheth_disconnect() and re-armed from\nipheth_sndbulk_callback() via queue_delayed_work_on(). The\nsame trigger on a kernel differing only by this patch reports 0 of 15,\nand the carrier check still functions across open/close cycles.\n\nThe reproducer needs an attached USB device that stops draining bulk OUT,\nplus a link down and unplug, driven as root. It is not a privilege\nboundary crossing and no exploit primitive was developed.\n\nFound by 0sec (https://0sec.ai)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:46.001Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45"
        },
        {
          "url": "https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962"
        },
        {
          "url": "https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"
        }
      ],
      "title": "net: usb: ipheth: fix carrier_work UAF on disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74677",
    "datePublished": "2026-08-22T15:32:46.001Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:46.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\n\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\n\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\nto the \"drop\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\nBecause tx_fixup() returned NULL, the local skb variable in\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\nmemory leak on every TX frame whose linearization fails (i.e. under\nmemory pressure).\n\nFree the skb before returning, matching the error handling already used\nfor the pskb_expand_head() failure path in the same function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On systems using the common ASIX AX88179/AX88178A USB 3.0 GbE adapter as their uplink, remote peers induce outbound TSO/GSO traffic that reaches ax88179_tx_fixup() via __dev_queue_xmit\u2192netdev_start_xmit\u2192usbnet_start_xmit; attacker-supplied or reply traffic over the bound NIC is standard network reachability.\nAC:L - NETIF_F_SG and NETIF_F_TSO are always enabled at bind; an attacker can send non-linear egress skbs and deliberately exhaust GFP_ATOMIC/slab memory so skb_linearize() fails on demand\u2014both prerequisites are fully under attacker control without races or rare layout.\nPR:N - No capability or authentication gates the netdev TX path; any remote host exchanging IP traffic with a victim whose ax88179 interface is up can trigger usbnet_start_xmit without local shell access, credentials, or init-namespace privileges.\nUI:N - Exploitation needs only that the adapter is plugged in and carrying traffic\u2014the normal always-on state for USB-Ethernet docks, kiosks, and laptops\u2014not any one-time victim action such as mounting media or opening a file.\nS:U - Leaked sk_buff objects remain in kernel SLAB caches within the same kernel security authority; there is no VM escape, container breakout, IOMMU bypass, or cross-boundary corruption.\nC:N - Orphaned skbs are not freed but are not exposed to userspace or adjacent objects; there is no out-of-bounds read, use-after-free, or other disclosure primitive\u2014only silent kernel heap consumption.\nI:N - The defect drops an skb reference on an error return without corrupting heap metadata, overwriting kernel objects, or enabling arbitrary writes or control-flow hijacking.\nA:H - Each skb_linearize() failure permanently leaks one skb; under attacker-driven memory pressure an unauthenticated remote peer can repeat TSO egress to exhaust kernel memory, provoking OOM-killer thrashing and denial of service on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:29.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922"
        },
        {
          "url": "https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade"
        },
        {
          "url": "https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664"
        },
        {
          "url": "https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4"
        }
      ],
      "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74678",
    "datePublished": "2026-08-22T15:32:46.765Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:29.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c8c6825a750fcd3efbe922847ca70ccd5a66857",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "a1c0deeba4a46481543d6b09c665f758c54c3a1a",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "d13f650a3485b58c124b3cda45597e8002c9c833",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "11413d7ed42174b8f5d8d0b6a25d10dc88239b21",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "d328fdc607fa1bb668ad512e1c918a120f78f337",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "fc9e54e22845c4da29588ca0986cb7c795b5a262",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            },
            {
              "lessThan": "6b1c8a9403a26cb0fed7a648916c74dc236da591",
              "status": "affected",
              "version": "370af734dfaf8336b496b386e194648e097e248a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_ncm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: Use unsigned int for ndp_index\n\nThe variable ndp_index is declared as a signed integer, but it stores\nthe return value of get_ncm(), which is unsigned.\n\nA malicious host can supply a large offset that overflows the signed\nndp_index, making it negative. Because ndp_index is compared against\nunsigned bounds, this negative value bypasses sanity checks and leads\nto an out-of-bounds read when calculating the address of the NDP\nblock (ntb_ptr + ndp_index).\n\nFix this by changing ndp_index to unsigned int to ensure consistent\nunsigned comparisons throughout the function."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:47.499Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c8c6825a750fcd3efbe922847ca70ccd5a66857"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1c0deeba4a46481543d6b09c665f758c54c3a1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d13f650a3485b58c124b3cda45597e8002c9c833"
        },
        {
          "url": "https://git.kernel.org/stable/c/11413d7ed42174b8f5d8d0b6a25d10dc88239b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d328fdc607fa1bb668ad512e1c918a120f78f337"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc9e54e22845c4da29588ca0986cb7c795b5a262"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b1c8a9403a26cb0fed7a648916c74dc236da591"
        }
      ],
      "title": "usb: gadget: f_ncm: Use unsigned int for ndp_index",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74679",
    "datePublished": "2026-08-22T15:32:47.499Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:47.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}