{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6133b461058316e3ccba7331f974d110d4c08b23",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "61093d7f1144f6a15bac505df35e5f535ade2ac1",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "645d98dbccdbfdbf0129f48822af7183492de091",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "993f7677949e3d72e360e86eed1f41c2511f75ed",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "939b6a41f681aea52af678053072ee443068e93e",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "2f73a065791d2a8e3f0bdf29248e33600359e865",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "0af047703dbed8224552587ed436f14a24371b46",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "c2f811314be351d86b6ab41e9297ae80d8da6f86",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()\n\nIf cxacru_cm() encounters an error while submitting or waiting for snd_urb,\nit aborts and returns the error without killing the already submitted\nrcv_urb. This leaves the rcv_urb active.\n\nWhen this happens during initialization (e.g., in cxacru_atm_start()), the\ndriver may ignore the error and proceed to call cxacru_poll_status(), which\ninvokes cxacru_cm() again. Attempting to submit the still-active rcv_urb\ntriggers a warning in usb_submit_urb():\n\ncxacru 1-1:1.0: send of cm 0x84 failed (-104)\nATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104\n------------[ cut here ]------------\nURB ffff88812658d200 submitted while active\nWARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0\ndrivers/usb/core/urb.c:379\n...\nCall Trace:\n \u003cTASK\u003e\n cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631\n cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline]\n cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828\n cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814\n usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927\n usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178\n cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370\n...\n\nTo fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts\nearly. We can safely call usb_kill_urb() on rcv_urb in the error path, as\nit is safe to call even if the URB is not active (e.g., if it failed to\nsubmit in the first place, or if it already completed)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:48.230Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6133b461058316e3ccba7331f974d110d4c08b23"
        },
        {
          "url": "https://git.kernel.org/stable/c/61093d7f1144f6a15bac505df35e5f535ade2ac1"
        },
        {
          "url": "https://git.kernel.org/stable/c/645d98dbccdbfdbf0129f48822af7183492de091"
        },
        {
          "url": "https://git.kernel.org/stable/c/993f7677949e3d72e360e86eed1f41c2511f75ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/939b6a41f681aea52af678053072ee443068e93e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f73a065791d2a8e3f0bdf29248e33600359e865"
        },
        {
          "url": "https://git.kernel.org/stable/c/0af047703dbed8224552587ed436f14a24371b46"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2f811314be351d86b6ab41e9297ae80d8da6f86"
        }
      ],
      "title": "usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74680",
    "datePublished": "2026-08-22T15:32:48.230Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:48.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/endpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6af5f29af7711233ae68d3b25c15d67478468900",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "f1fbb50b99311b35c2e85cc70341d62082dca4b5",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "137bf034740e5a2734794908d0aff1e0bd7cee6e",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "6607f85242577f33d4540a0d1f4a6137f5367058",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "0a235379825e1a6194e43861ee6658e5fc35686d",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "d3ed4e6321bb453757044cb9e5ecb30a33f04903",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            },
            {
              "lessThan": "69ee44e1a23be62318189dc4b37fa4ad94053269",
              "status": "affected",
              "version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/endpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write on Type II inbound URBs\n\ndata_ep_set_params() sizes each URB transfer buffer before it adds the\nFormat Type II transfer delimiter:\n\n\tu-\u003epackets = urb_packs;\n\tu-\u003ebuffer_size = maxsize * u-\u003epackets;\n\n\tif (fmt-\u003efmt_type == UAC_FORMAT_TYPE_II)\n\t\tu-\u003epackets++; /* for transfer delimiter */\n\tu-\u003eurb = usb_alloc_urb(u-\u003epackets, GFP_KERNEL);\n\nbuffer_size is computed from the pre-increment packet count and never\nrecomputed, so for a Type II endpoint the buffer is one packet short of\nthe packet count the URB is built with.\n\nprepare_inbound_urb() then lays out one iso frame per packet and never\nconsults buffer_size:\n\n\toffs = 0;\n\tfor (i = 0; i \u003c urb_ctx-\u003epackets; i++) {\n\t\turb-\u003eiso_frame_desc[i].offset = offs;\n\t\turb-\u003eiso_frame_desc[i].length = ep-\u003ecurpacksize;\n\t\toffs += ep-\u003ecurpacksize;\n\t}\n\n\turb-\u003etransfer_buffer_length = offs;\n\turb-\u003enumber_of_packets = urb_ctx-\u003epackets;\n\nThe last descriptor therefore points one packet past the end of the\ntransfer buffer, where the host controller writes device data on every\ninbound transfer.  prepare_silent_urb() and prepare_playback_urb() bound\ntheir fill loops by ctx-\u003ebuffer_size, so only capture is affected.\n\nfmt_type comes from the device\u0027s audio streaming descriptors, so any\ndevice advertising a Type II capture format hits this once userspace sets\nhw_params on the stream.\n\nKASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report\nper inbound transfer:\n\n  BUG: KASAN: slab-out-of-bounds in dummy_timer\n  Write of size 64 at addr ffff0000186171c0 by task cons02/166\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Allocated by task 166:\n   usb_alloc_coherent\n   snd_usb_endpoint_set_params\n  The buggy address is located 0 bytes to the right of\n   allocated 64-byte region [ffff000018617180, ffff0000186171c0)\n\nCompute buffer_size after the delimiter packet has been accounted for,\nand bound the fill loop by buffer_size, as prepare_silent_urb() already\ndoes on the outbound side.  This grows every Type II URB allocation by\none maxsize packet.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:49.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903"
        },
        {
          "url": "https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269"
        }
      ],
      "title": "ALSA: usb-audio: fix OOB write on Type II inbound URBs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74682",
    "datePublished": "2026-08-22T15:32:49.527Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:49.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/evdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c79b08d8fa230871a3634e34a66e591ac2d084ef",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "f27fa9b39f925d26e034a1f382cb45523138f4ae",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "f3fc329acad9a71b3c077237cbac20670d2358c8",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "5db341189bb7ff041d570dbe36ecca7e32913927",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "433913b4a92214d76e9f0c03ad9128fec943d5f8",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "4034ef247a9dde3f56660b01f0c3280dac6b1274",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "810e1883d4815f29c30d900ad7333d03cc2515d1",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            },
            {
              "lessThan": "3abd29c61d2ef37c4102cf755b18be53bb9dbea6",
              "status": "affected",
              "version": "06a16293f71927f756dcf37558a79c0b05a91641",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/evdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - sanitize event type index when fetching event masks\n\nThe user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK\nioctls is used to index the static counts array in evdev_get_mask_cnt()\nand client evmasks array in evdev_get_mask().\n\nWhile the event type is architecturally bounded by EV_CNT, speculative\nexecution may mispredict bounds checks and perform out-of-bounds loads.\n\nSanitize the event type index in evdev_get_mask_cnt() branchlessly using\narray_index_mask_nospec(). This clamps the index to 0 for safe array\naccess and forces the returned count to 0 speculatively when the index\nis out of bounds.\n\nWe do not need additional array_index_nospec() calls in evdev_get_mask()\nbecause evdev_get_mask_cnt() speculatively forces the count (and\nresulting xfer_size) to 0 for out-of-bounds types, preventing any\nspeculative memory access to client evmasks array."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:23:19.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c79b08d8fa230871a3634e34a66e591ac2d084ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/f27fa9b39f925d26e034a1f382cb45523138f4ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3fc329acad9a71b3c077237cbac20670d2358c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5db341189bb7ff041d570dbe36ecca7e32913927"
        },
        {
          "url": "https://git.kernel.org/stable/c/433913b4a92214d76e9f0c03ad9128fec943d5f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4034ef247a9dde3f56660b01f0c3280dac6b1274"
        },
        {
          "url": "https://git.kernel.org/stable/c/810e1883d4815f29c30d900ad7333d03cc2515d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3abd29c61d2ef37c4102cf755b18be53bb9dbea6"
        }
      ],
      "title": "Input: evdev - sanitize event type index when fetching event masks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74683",
    "datePublished": "2026-08-22T15:32:50.192Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:23:19.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15583b07fd691a844fbf7b3ad612cdc9e9a657c0",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "lessThan": "8b444b126cd8e4473e652f529753ed4dd1360a9c",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "lessThan": "164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "lessThan": "3874892dd27d5387aa9a06f58d9060f18f351d24",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54ef8243c3c8e90f1ea5792e6752e021a25c8eb3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca278267d6cd9544645731732455b6b20cb0e895",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "faa3baa2828c5e1c4374f3e60041f75c64f5fcb6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.226",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.181",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.106",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.106",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()\n\nThe commit 4f61f133f354 (\"net: tap: NULL pointer derefence in\ndev_parse_header_protocol when skb-\u003edev is null\") fixed a crash in\ntap_get_user() by assigning skb-\u003edev before calling tun_vnet_hdr_to_skb().\nThis is required because virtio_net_hdr_to_skb() may invoke\ndev_parse_header_protocol(), which dereferences skb-\u003edev. Without the\nassignment, a NULL pointer dereference can occur.\n\nHowever, tap_get_user_xdp() still parses the virtio-net header before\nassigning skb-\u003edev. When the vhost TX path passes an XDP buffer containing\na GSO virtio-net header but the protocol is set to zero on purpose,\ntun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb-\u003edev\nis still NULL, resulting in a crash.\n\nFix this by looking up the tap device and assigning skb-\u003edev before calling\ntun_vnet_hdr_to_skb(), matching the ordering already used in\ntap_get_user(). Preserve the existing RCU read-side critical section across\ndev_queue_xmit()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious KVM guest reaches tap_get_user_xdp() by kicking the virtio-net TX virtqueue; vhost_net handle_tx_copy batches XDP buffers and invokes tap_sendmsg(TUN_MSG_PTR), not via any host network packet-receive path.\nAC:L - On typical QEMU/KVM vhost-net+tap/macvtap backends with TX batching enabled, a guest fully controls virtio-net GSO headers and Ethernet frames; sending GSO with ethertype 0 deterministically hits dev_parse_header_protocol() with skb-\u003edev NULL without races.\nPR:N - No host root or capabilities are required; a malicious cloud VM tenant only needs code execution inside a guest using virtio-net with a vhost-net tap backend, matching other guest-to-host virtio/KVM CNA scores.\nUI:N - No separate victim action is needed; the attacker submits crafted virtio-net TX descriptors from their own guest workload during normal VM operation without requiring host administrator interaction.\nS:C - Guest-supplied virtio-net TX data triggers a NULL pointer dereference in host tap_get_user_xdp(), panicking the physical host kernel and crossing the KVM guest-to-host virtualization security boundary.\nC:N - The failure mode is a NULL pointer dereference at dev-\u003eheader_ops with skb-\u003edev unset; there is no demonstrated out-of-bounds read, use-after-free, or other memory corruption that could disclose host kernel data.\nI:N - No guest-controlled host memory write or control-flow hijack occurs; the host kernel oopses on the NULL dereference before any exploitable modification beyond the immediate crash.\nA:H - The NULL pointer dereference in dev_parse_header_protocol() provokes a host kernel oops/panic in the vhost worker during guest virtio-net TX, denying availability of the hypervisor and all co-resident VMs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:30.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15583b07fd691a844fbf7b3ad612cdc9e9a657c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24"
        }
      ],
      "title": "net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74684",
    "datePublished": "2026-08-22T15:32:50.846Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:30.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/ltc4282.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60e06c4dba696173982393252a40ceb7dd2eec18",
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "versionType": "git"
            },
            {
              "lessThan": "de58b90a4d1417c15b693eb04c0ce6bc925d84c6",
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "versionType": "git"
            },
            {
              "lessThan": "046e56b53c09375ef39903514496aa5508db9729",
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "versionType": "git"
            },
            {
              "lessThan": "e253dd5f9f6d875a317895bf43ec9534ed7523cb",
              "status": "affected",
              "version": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/ltc4282.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ltc4282) Clamp negative current limits\n\nWhen a negative value is passed to ltc4282_write_curr(), the signed long\nval is cast directly to u64:\n\ndrivers/hwmon/ltc4282.c:ltc4282_write_curr() {\n        /* need to pass it in millivolt */\n        u32 in = DIV_ROUND_CLOSEST_ULL((u64)val * st-\u003ersense, DECA * MICRO);\n        ...\n}\n\nThis cast converts negative inputs into large positive values. The\nsubsequent division result overflows the u32 in variable, truncating\nto a pseudo-random positive value. When this is passed to\nltc4282_write_voltage_byte(), it is clamped to the maximum limit instead\nof zero.\n\nClamp val to 0 and to the maximum supported upper limit before the cast\nand assign the result to a 64-bit temporary variable before the division\nto avoid the underflow and an also possible overflow."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:51.493Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60e06c4dba696173982393252a40ceb7dd2eec18"
        },
        {
          "url": "https://git.kernel.org/stable/c/de58b90a4d1417c15b693eb04c0ce6bc925d84c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/046e56b53c09375ef39903514496aa5508db9729"
        },
        {
          "url": "https://git.kernel.org/stable/c/e253dd5f9f6d875a317895bf43ec9534ed7523cb"
        }
      ],
      "title": "hwmon: (ltc4282) Clamp negative current limits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74685",
    "datePublished": "2026-08-22T15:32:51.493Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-22T15:32:51.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "fad4766a74220fe579c6fcaa10ba01c23529814f",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "936658ec41c28c397ef390140e02d4c91ade92f0",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "8de65194a04d2552cd39b6c67d942d490f22d174",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "6160e756db81d6cb63e3e2952efcf6c5134be385",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "18d704bdd809377dfd81a3c2f42426763b5da227",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "c9158ceaf27780ef64534ad72f44ffde3f8ccc49",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear control chunk transport if it is being removed\n\nsctp_make_heartbeat_ack() caches the destination transport in\nchunk-\u003etransport without taking a reference. When src_out_of_asoc_ok is\nenabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead\nof being transmitted immediately.\n\nIf the peer transport is removed while the chunk is still queued,\nsctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,\nbut only clears cached transport pointers in out_chunk_list.  The queued\ncontrol chunk therefore retains a dangling transport pointer.\n\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is\ntransmitted, SCTP dereferences the stale transport pointer, leading to a\nuse-after-free.\n\nFix this by also clearing chunk-\u003etransport for queued control chunks in\ncontrol_chunk_list when removing the transport."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from remotely received SCTP packets (HEARTBEAT, ASCONF, ASCONF_ACK) processed in sctp_rcv() and the association input state machine on internet-facing SCTP servers and telecom endpoints.\nAC:L - A remote SCTP peer controls packet sequencing and can send HEARTBEAT while src_out_of_asoc_ok blocks transmission, remove transports via ASCONF DEL_IP, then trigger flush when ASCONF_ACK clears suppression.\nPR:N - Exploitation requires only a network-reachable established SCTP association; the attacker needs no Linux credentials, capabilities, or namespaces\u2014only the ability to send valid SCTP traffic to the target.\nUI:N - No victim user action is required; the use-after-free is triggered entirely by SCTP protocol messages sent by a remote peer during normal association operation or address migration.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Stale chunk-\u003etransport pointers dereference RCU-freed sctp_transport objects in sctp_outq_select_transport() and sctp_packet_transmit(), a use-after-free that enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of sctp_transport allows controlled reuse of freed kmalloc objects, providing a standard path to arbitrary kernel writes and local privilege escalation or remote code execution in kernel context.\nA:H - Dereferencing the freed transport during control-chunk transmission can immediately kernel oops or panic the system; use-after-free bugs inherently threaten availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:32.712Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886"
        },
        {
          "url": "https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f"
        },
        {
          "url": "https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174"
        },
        {
          "url": "https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385"
        },
        {
          "url": "https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49"
        }
      ],
      "title": "sctp: clear control chunk transport if it is being removed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74688",
    "datePublished": "2026-08-22T15:32:53.423Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:32.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/atm/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3bcd5d65ac03c15787b2a5b36c718e26a689336",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "35f258fee9ed358c6d0f57f91c30bf029c3724af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6eb6af88710977eb529b558a07294874d8c40c4d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f77c1ab382188f5b51982fab6d913443b6dc59f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c5988c7349c0b64a7e0441bfc6e1dca54f7116a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/atm/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/atm: fix slab-out-of-bounds read in vcc_setsockopt()\n\nvcc_setsockopt() contained an ineffective optlen check:\n  if (__SO_LEVEL_MATCH(optname, level) \u0026\u0026 optlen != __SO_SIZE(optname))\n      return -EINVAL;\n\nIf __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller\npassed a mismatched level), the length check optlen != __SO_SIZE(optname)\nwas short-circuited and bypassed. Execution then fell through to switch(optname),\ncalling copy_from_sockptr() assuming optval contained sufficient space.\n\nFurthermore, even if level matched, a cgroup BPF setsockopt filter could shrink\noptlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),\nthis leads to a KASAN slab-out-of-bounds read when optlen is smaller than the\nexpected structure size.\n\nFix this by using copy_safe_from_sockptr(), which unconditionally validates\nthat optlen is at least the expected size before copying. Also change the local\n\u0027value\u0027 variable type from \u0027unsigned long\u0027 to \u0027int\u0027 so that SO_SETCLP matches\nits sizeof(int) ABI encoding on 64-bit systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the local setsockopt(2) syscall on an AF_ATMPVC/AF_ATMSVC socket (do_sock_setsockopt -\u003e pvc_setsockopt/svc_setsockopt -\u003e vcc_setsockopt); no remote ATM packet or network-facing handler invokes this path.\nAC:L - The attacker fully controls level, optname, and optlen; passing a mismatched level bypasses the short-circuited length check, and cgroup BPF setsockopt can shrink optlen after entry, deterministically triggering a full-size memcpy past a small kmalloc buffer with no race.\nPR:L - No capability check guards SO_ATMQOS or SO_SETCLP on unconnected ATM sockets; any unprivileged local user in init_net (required because ATM socket creation rejects non-init network namespaces) can open AF_ATMPVC sockets and issue the crafted setsockopt without CAP_NET_ADMIN.\nUI:N - The attacker triggers the out-of-bounds read entirely from their own process with a single crafted setsockopt call; no victim interaction or cooperation is required.\nS:U - Impact is kernel heap memory disclosure and potential crash within the host kernel security boundary; no VM escape, IOMMU bypass, or cross-sandbox boundary crossing occurs.\nC:H - copy_from_sockptr() performs a slab-out-of-bounds read of up to 92 bytes (struct atm_qos) or 8 bytes (SO_SETCLP) past a kmalloc buffer into kernel stack memory; adjacent slab contents can populate vcc-\u003eqos and be retrieved via subsequent SO_ATMQOS getsockopt.\nI:N - The defect is a pure out-of-bounds read with no arbitrary kernel write, heap corruption, or control-flow hijack primitive; although leaked bytes may influence vcc-\u003eqos if validation passes, no attacker-controlled data modification occurs.\nA:H - The KASAN-reported slab-out-of-bounds read triggers kernel oops on hardened kernels, and reading past a small kmalloc object into adjacent slab memory on production kernels risks faulting on unmapped redzone pages or corrupting adjacent objects leading to panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:33.932Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3bcd5d65ac03c15787b2a5b36c718e26a689336"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f258fee9ed358c6d0f57f91c30bf029c3724af"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eb6af88710977eb529b558a07294874d8c40c4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f77c1ab382188f5b51982fab6d913443b6dc59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c5988c7349c0b64a7e0441bfc6e1dca54f7116a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3"
        }
      ],
      "title": "net/atm: fix slab-out-of-bounds read in vcc_setsockopt()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74689",
    "datePublished": "2026-08-22T15:32:54.034Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:33.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/thunderbolt/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cce39109206bc5497e0953806563644b88bfc44",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            },
            {
              "lessThan": "0da9a6d27155ad072dd76db8cd637feead99a0e0",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            },
            {
              "lessThan": "b5a21615f627c48dafaa6ef82a34a5b97a4352aa",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            },
            {
              "lessThan": "103a9b663ac1cacb8465aeff18f84a247154a562",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            },
            {
              "lessThan": "4dd71cb0d23d40cb58fe4261c7bd183dca66caa0",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            },
            {
              "lessThan": "9a482b2b117e5fa656b6d24fc01799e8ac2d4368",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            },
            {
              "lessThan": "68bf02b6b4ad3f748c6db71fd77b6c0402d252f4",
              "status": "affected",
              "version": "e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/thunderbolt/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: Tear down DMA paths before stopping the rings\n\ntbnet_tear_down() stops both rings and frees their frame buffers before\ncalling tb_xdomain_disable_paths().  tb_ring_stop() zeroes the ring\u0027s\ndescriptor base and tbnet_free_buffers() unmaps and frees the pages the\nframes sit in, so by the time __tb_path_deactivate_hop() polls the hop\u0027s\n\u0027pending\u0027 bit, anything still in flight has nowhere to drain to.\n\nThe teardown sequence has been in this order since the driver was added.\nThe setup path has not: commit ff7cd07f3064 (\"net: thunderbolt: Enable\nDMA paths only after rings are enabled\") moved the path enable to the end\nof tbnet_connected_work() and documented why:\n\n\t/* Both logins successful so enable the rings, high-speed DMA\n\t * paths and start the network device queue.\n\t *\n\t * Note we enable the DMA paths last to make sure we have primed\n\t * the Rx ring before any incoming packets are allowed to\n\t * arrive.\n\t */\n\nTeardown was never updated to match, so the rings and the paths now come\ndown in the same order they go up instead of in reverse.\n\nOn an ASMedia ASM4242 host router the \u0027pending\u0027 bit then never clears:\nevery teardown burns the full 500 ms timeout and\n__tb_path_deactivate_hop() returns -ETIMEDOUT.  Raising the timeout to\n5 s does not help, so the hop is not slow to drain, it never drains\nat all.\n\nThe failure is invisible above the thunderbolt core.\n__tb_path_deactivate_hops() is void and only calls tb_port_warn();\ntb_path_deactivate(), tb_tunnel_deactivate() and\n__tb_disconnect_xdomain_paths() are void as well, and\ntb_disconnect_xdomain_paths() ends in an unconditional \"return 0\".  So\ntb_xdomain_disable_paths() reports success and the netdev_warn() below\nit never fires.  Repeated teardowns eventually take the XDomain control\nchannel down, after which the peer node is gone and only a power cycle\nbrings the controller back.\n\nDeactivating the paths first fixes it.  Measured with kretprobes on a\nstock v6.17 tree with no other patches applied, on a link that was up\nand had just carried traffic:\n\n  before: __tb_path_deactivate_hop() returns 0 for the first hop, then\n          -ETIMEDOUT for the second 500335 us later\n  after:  0 for both, 525 us apart\n\nAlternating the two orderings ABBA over three load levels, four\nteardowns per arm: every teardown failed before the change (21 of 21\nthat ran), none failed after (0 of 24).  The before arms ran short\nbecause the link died partway through.  The same split shows up when\nthe interface is enslaved to a bond instead of just brought down, which\nis how I ran into this in the first place.  Throughput and latency after\nthe change are unchanged.\n\nHosts whose routers drain the hop despite the stale descriptor base see\nno functional difference, since the paths end up deactivated either way."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when tbnet_tear_down() runs during ThunderboltIP session teardown; a malicious peer on the same direct Thunderbolt/USB4 link can send TBIP_LOGOUT over XDomain to queue disconnect_work without any local syscall, matching the adjacent-peer model used for other tbnet CVEs.\nAC:L - On affected host routers (e.g. ASMedia ASM4242) the reporter measured 21/21 failed teardowns versus 0/24 after the fix; an adjacent peer can reliably trigger teardown during active traffic by sending logout or forcing reconnect cycles without races or layout dependencies.\nPR:N - No Linux account, capability, or init-namespace privilege is required on the victim; any Thunderbolt/USB4 peer that completes the automatic ThunderboltIP login handshake can send TBIP_LOGOUT to invoke tbnet_handle_packet() and reach the vulnerable teardown path.\nUI:N - Once a ThunderboltIP session is established, which is typical for docks, direct laptop links, and bonded interfaces, the peer can trigger the faulty teardown repeatedly without further victim interaction beyond the existing cable connection.\nS:U - Impact is confined to the host kernel Thunderbolt controller and XDomain networking stack (hop drain failure, control-channel loss, power-cycle recovery) and does not cross VM, container, or IOMMU isolation boundaries.\nC:H - Stopping rings and calling tbnet_free_buffers() unmaps and frees RX/TX frame pages before tb_xdomain_disable_paths() drains hops; with pending in-flight Thunderbolt DMA this teardown race can expose or corrupt repurposed kernel memory, satisfying the higher-severity memory-corruption class when impact is uncertain.\nI:H - The same premature buffer unmap/free while DMA paths remain active can let in-flight NHI DMA target freed frame pages, enabling attacker-influenced kernel memory writes or control-flow corruption beyond the observed controller hang.\nA:H - Repeated teardowns leave hops stuck pending, eventually kill the XDomain control channel, and strand the peer until a full power cycle; bond enslavement and interface down paths also reliably trigger this denial of service on vulnerable hardware."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:36.384Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cce39109206bc5497e0953806563644b88bfc44"
        },
        {
          "url": "https://git.kernel.org/stable/c/0da9a6d27155ad072dd76db8cd637feead99a0e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5a21615f627c48dafaa6ef82a34a5b97a4352aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/103a9b663ac1cacb8465aeff18f84a247154a562"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dd71cb0d23d40cb58fe4261c7bd183dca66caa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a482b2b117e5fa656b6d24fc01799e8ac2d4368"
        },
        {
          "url": "https://git.kernel.org/stable/c/68bf02b6b4ad3f748c6db71fd77b6c0402d252f4"
        }
      ],
      "title": "net: thunderbolt: Tear down DMA paths before stopping the rings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74691",
    "datePublished": "2026-08-22T15:32:55.258Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:36.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "lessThan": "feb71634bb1abab3e8fb5cde874b27001cc1282e",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "lessThan": "01865e1ddb126b25ac9eba5cdd7ec49e11183a64",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "lessThan": "00f89433777236ced4771211047fb5d4cd581cea",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "lessThan": "78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "lessThan": "ff5bcd804b5bc5c64736b7d318c20e12ea9506b8",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "lessThan": "185a4caeecabc150106deda1da170b09f2ad803f",
              "status": "affected",
              "version": "fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1d004585b40c212b338fc8a40cbaaf230ea4703",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.299",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.299",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix TOCTOU race between smc_listen_out() and listener close\n\nsmc_listen_out() reads lsmc-\u003esk.sk_state without the listener lock,\nthen acquires lock_sock_nested() only after the check passes. This\nopens a window where smc_close_active() can transition the listener\nto SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept\nqueue, and release the lock, all between the lockless read and the\ndelayed lock acquisition:\n\n  smc_listen_work (smc_hs_wq)          smc_close_active()\n  -------------------------------      -------------------------\n  release_sock(child)\n  if (sk_state == SMC_LISTEN) TRUE\n                                        lock_sock(listener)\n                                        sk_state = SMC_CLOSED\n                                        smc_close_cleanup_listen()\n                                        release_sock(listener)\n                                        flush_work(tcp_listen_work)\n  lock_sock_nested(listener)\n  smc_accept_enqueue(listener, child) /* child enqueued on dead listener */\n\nsmc_close_active() flushes only tcp_listen_work. Work items already\ndispatched onto smc_hs_wq for the CLC handshake continue running\nunguarded. smc_accept_enqueue() takes a sock_hold() on the child that\nis never released, so the child smc_sock, its clcsock, and the\nreference all leak. A remote peer that opens TCP connections while the\nserver calls close() can exhaust kernel memory.\n\nMove lock_sock_nested() to before the sk_state check so that the test\nand the enqueue are atomic under the listener lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug fires when smc_listen_work() on smc_hs_wq finishes an inbound SMC/TCP handshake queued by smc_tcp_listen_work() for each remote connection to an AF_SMC listener, so any network peer that reaches the listener port drives the full path via SYN and CLC messages.\nAC:L - The attacker controls handshake completions by flooding SMC-capable TCP connections and overlapping them with listener close(), either by timing floods against restarts or locally by running server and client together; smc_close_active() only flushes tcp_listen_work, leaving smc_hs_wq workers racing through the unlocked sk_state check.\nPR:N - SMC performs no authentication; smc_create() and smc_listen() enforce no capabilities, and smc_listen_work() processes the CLC handshake immediately after TCP accept before any credential verification, so an unauthenticated remote peer need only reach the listener port.\nUI:N - Exploitation requires only inbound network connections and kernel handshake/close processing; no end-user action such as opening a file or mounting a filesystem is needed, and listener shutdown during deployments or restarts is routine automated server behavior.\nS:U - The leak accumulates orphaned smc_sock structures and clcsock references within the kernel networking subsystem on the targeted host; it does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The bug is an unreleased sock_hold() leaving child sockets on a closed listener accept queue; objects are never freed prematurely, so there is no out-of-bounds read, use-after-free dereference, or kernel data disclosure to the attacker.\nI:N - Only reference counts are incremented without matching decrements; no memory is written out of bounds, no freed object is reused, and no control-flow or integrity primitive is obtained\u2014only unreclaimable kernel allocations accumulate.\nA:H - Each successful race permanently leaks a child smc_sock, its clcsock, and sock references that smc_close_cleanup_listen() can never drain; a remote peer repeating handshakes during listener close can exhaust kernel memory and cause system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:37.608Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa"
        },
        {
          "url": "https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e"
        },
        {
          "url": "https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64"
        },
        {
          "url": "https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f"
        }
      ],
      "title": "net/smc: fix TOCTOU race between smc_listen_out() and listener close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74692",
    "datePublished": "2026-08-22T15:32:55.873Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:37.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/prestera/prestera_pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "38a3afbf9fd8a2e8c47fa3ca47b425a8a9623240",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "0fbcceb9d19f2d1dcdf099aee590f2517cb718bb",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "e0f382e8084117f0b11ffb070fe1079e38c0d7f9",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "6fad06bb793d7089ae05b9fcf46e11be2dfe4850",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "470ac9cce7308e60cf2dceb448749cdd006e73de",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "363e048a9d0a6c245cbc348c8a220170afed046a",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "7fa8a12296d8d5aa4b1c3904f0b354d81124cf29",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            },
            {
              "lessThan": "8ae344eb540af3f457179b52bc6061416752485c",
              "status": "affected",
              "version": "4c2703dfd7fabb0824b3bc345f9fa47e33248c14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/prestera/prestera_pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prestera: validate firmware header length\n\nprestera_fw_hdr_parse() reads the firmware header before checking\nthat the firmware image contains that header.\n\nReject images shorter than struct prestera_fw_header before decoding the\nmagic and version fields."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:56.491Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/38a3afbf9fd8a2e8c47fa3ca47b425a8a9623240"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbcceb9d19f2d1dcdf099aee590f2517cb718bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0f382e8084117f0b11ffb070fe1079e38c0d7f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fad06bb793d7089ae05b9fcf46e11be2dfe4850"
        },
        {
          "url": "https://git.kernel.org/stable/c/470ac9cce7308e60cf2dceb448749cdd006e73de"
        },
        {
          "url": "https://git.kernel.org/stable/c/363e048a9d0a6c245cbc348c8a220170afed046a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fa8a12296d8d5aa4b1c3904f0b354d81124cf29"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ae344eb540af3f457179b52bc6061416752485c"
        }
      ],
      "title": "net: prestera: validate firmware header length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74693",
    "datePublished": "2026-08-22T15:32:56.491Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-22T15:32:56.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}