{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "201633f47b542a99bb7baafdfcda7781249fb3d9",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            },
            {
              "lessThan": "e28420e36542ae8b66a5bdcec419525f521bddf8",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            },
            {
              "lessThan": "9cd9a983769a4d0e9cc80a287316ee79685d38b3",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            },
            {
              "lessThan": "3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/gfx: fix cleaner shader IB buffer overflow\n\nThe cleaner shader sysfs path allocates a 16-dword (64 byte) IB but\nincorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is\n0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a\nkernel page fault.\n\nThe IB only needs to be a minimal NOP shell to schedule the job; the\ncleaner shader itself is emitted on the ring via emit_cleaner_shader().\nFill 16 dwords to match the allocation.\n\nv2: Use ib_size_dw variable (Lijo)\n\n(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:10.194Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/201633f47b542a99bb7baafdfcda7781249fb3d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e28420e36542ae8b66a5bdcec419525f521bddf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cd9a983769a4d0e9cc80a287316ee79685d38b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3"
        }
      ],
      "title": "drm/amdgpu/gfx: fix cleaner shader IB buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68276",
    "datePublished": "2026-08-10T12:01:51.789Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-17T05:02:10.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/ib.c",
            "net/rds/ib_cm.c",
            "net/rds/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7809344be3f0c1bbfdfdde1cefafeec14bf52d51",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "438dec9b0a06bd1f8db8c58539c655e735e17367",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "b61c9eb5931bb7389bc104faacd8c17d910da65d",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "8e48d7ab1e01936a172ff31531904b003895fd8c",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "a8302e758050e6a922765aee8d220a4fd350f52d",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "f6787fdffcae5490c779f0f3f33b11597525d1ae",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "00d5707217b5972554898ff734ae7b71bce704e6",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            },
            {
              "lessThan": "9c805e592a29be9e4e61ff1bd567da04aa8fd6f9",
              "status": "affected",
              "version": "eee2fa6ab3225192d6d894c54a6fb02ac9efdff6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/ib.c",
            "net/rds/ib_cm.c",
            "net/rds/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable=1\u0027 parameter, inet6_addr_lst\nis never initialized because inet6_init() exits before addrconf_init()\nis called to initialize it. An attempt to bind an RDS socket to\nan ipv6 address results in a crash in __ipv6_chk_addr_and_flags()\n\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nRIP: 0010:__ipv6_chk_addr_and_flags+0x1df/0x7e0\nCall Trace:\n \u003cTASK\u003e\n ipv6_chk_addr+0x3b/0x50\n rds_tcp_laddr_check+0x155/0x3b0 [rds_tcp]\n rds_trans_get_preferred+0x15d/0x2d0 [rds]\n ? trace_hardirqs_on+0x2d/0x110\n rds_bind+0x1433/0x1d60 [rds]\n ? rds_remove_bound+0xd50/0xd50 [rds]\n ? aa_af_perm+0x250/0x250\n ? __might_fault+0xde/0x190\n ? __sys_bind+0x1dc/0x210\n __sys_bind+0x1dc/0x210\n ? __ia32_sys_socketpair+0x100/0x100\n ? restore_fpregs_from_fpstate+0x53/0x100\n __x64_sys_bind+0x73/0xb0\n ? syscall_enter_from_user_mode+0x1c/0x50\n do_syscall_64+0x34/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\nRIP: 0033:0x7f47f8269ea9\n \u003c/TASK\u003e\n\nThe following code reproduces the issue:\n\nstruct sockaddr_in6 addr;\ns = socket(PF_RDS, SOCK_SEQPACKET, 0);\n\nmemset(\u0026addr, 0, sizeof(addr));\ninet_pton(AF_INET6, ADDRESS, \u0026addr.sin6_addr);\naddr.sin6_family = AF_INET6;\naddr.sin6_port = htons(PORT);\n\nbind(s, \u0026addr, sizeof(addr));\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:12.816Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7809344be3f0c1bbfdfdde1cefafeec14bf52d51"
        },
        {
          "url": "https://git.kernel.org/stable/c/438dec9b0a06bd1f8db8c58539c655e735e17367"
        },
        {
          "url": "https://git.kernel.org/stable/c/b61c9eb5931bb7389bc104faacd8c17d910da65d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e48d7ab1e01936a172ff31531904b003895fd8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8302e758050e6a922765aee8d220a4fd350f52d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6787fdffcae5490c779f0f3f33b11597525d1ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/00d5707217b5972554898ff734ae7b71bce704e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c805e592a29be9e4e61ff1bd567da04aa8fd6f9"
        }
      ],
      "title": "rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68322",
    "datePublished": "2026-08-10T12:02:57.499Z",
    "dateReserved": "2026-07-30T09:28:09.382Z",
    "dateUpdated": "2026-08-19T16:33:12.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_tcm.c",
            "drivers/usb/gadget/function/tcm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fb317058d165c88f3344f59439c14872c162b3c",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "90431d8523c0c1c9f8e3e3f0895727063f93da85",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "ee07d09419f1c59c74f73107aa08444f2f2fc6c8",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "3118bb872c7dff653294f193d5328a476619e04d",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "a6eb5a0ae7cd313cfd7df78decd8f43b64c68703",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "f282242906c12fd476b86757afba51f211d4f959",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "4c6c6a5588b9a2f8437fb794e852d05fa60ebe53",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            },
            {
              "lessThan": "79e2d75725c85607f8a9d87ae9cace62a19f767d",
              "status": "affected",
              "version": "c52661d60f636d17e26ad834457db333bd1df494",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_tcm.c",
            "drivers/usb/gadget/function/tcm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: synchronize delayed set_alt with teardown\n\nThe f_tcm set_alt() path defers endpoint setup to a work item and\ncompletes the delayed status response from process context. The delayed\nwork uses f_tcm private state and may complete the setup request after\ndisconnect or function teardown has already moved on.\n\nCancel and drain the delayed set_alt work when the function is unbound or\nfreed. For disable paths, which are reached under the composite device\nlock, use a small state machine and a non-sleeping cancellation path\ninstead of cancel_work_sync(). If the work is already running, mark it\ncancelled and let the worker own the cleanup; otherwise tcm_disable() can\ncancel the queued work and clean up immediately.\n\nAlso serialize the final delayed-status completion with the cancellation\ncheck while holding the composite device lock. This prevents a disconnect\nfrom clearing delayed_status while the worker is about to complete the\ncontrol request.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? tcm_delayed_set_alt+0x6c/0xef0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x188/0x320\n ? tcm_delayed_set_alt+0x6c/0xef0\n kasan_report+0xe0/0x110\n ? tcm_delayed_set_alt+0x6c/0xef0\n tcm_delayed_set_alt+0x6c/0xef0\n ? __pfx_tcm_delayed_set_alt+0x10/0x10\n ? process_one_work+0x4cb/0xb90\n ? rcu_is_watching+0x20/0x50\n ? tcm_delayed_set_alt+0x9/0xef0\n process_one_work+0x4d7/0xb90\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_tcm_delayed_set_alt+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 544:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n tcm_alloc+0x68/0x180\n usb_get_function+0x36/0x60\n config_usb_cfg_link+0x125/0x1b0\n configfs_symlink+0x322/0x890\n vfs_symlink+0xc2/0x270\n filename_symlinkat+0x295/0x2f0\n __x64_sys_symlinkat+0x62/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 661:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x2f9/0x530\n config_usb_cfg_unlink+0x173/0x1e0\n configfs_unlink+0x1fa/0x340\n vfs_unlink+0x15c/0x510\n filename_unlinkat+0x2ba/0x450\n __x64_sys_unlinkat+0x63/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:18.779Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fb317058d165c88f3344f59439c14872c162b3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/90431d8523c0c1c9f8e3e3f0895727063f93da85"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee07d09419f1c59c74f73107aa08444f2f2fc6c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3118bb872c7dff653294f193d5328a476619e04d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6eb5a0ae7cd313cfd7df78decd8f43b64c68703"
        },
        {
          "url": "https://git.kernel.org/stable/c/f282242906c12fd476b86757afba51f211d4f959"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6c6a5588b9a2f8437fb794e852d05fa60ebe53"
        },
        {
          "url": "https://git.kernel.org/stable/c/79e2d75725c85607f8a9d87ae9cace62a19f767d"
        }
      ],
      "title": "usb: gadget: f_tcm: synchronize delayed set_alt with teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68367",
    "datePublished": "2026-08-10T12:03:44.600Z",
    "dateReserved": "2026-07-30T09:28:09.385Z",
    "dateUpdated": "2026-08-23T12:46:18.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22f1aa35b87e471cc31b35b74451f46630863b12",
              "status": "affected",
              "version": "df3a4518aee64f21bcafa891105b468413f27431",
              "versionType": "git"
            },
            {
              "lessThan": "928dda88d0e13fbca381255028f65b244343a4ea",
              "status": "affected",
              "version": "543c12c2644e772caa6880662c2a852cfdc5a10c",
              "versionType": "git"
            },
            {
              "lessThan": "d8e5c5672724b8f3c4c099d2cf60239c996e5424",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "lessThan": "32e486b70c256d5ef4baa5a2936ade2fea50e8eb",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "lessThan": "d9e9753dfd43bd27c956578df7804a3c90b80fdc",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "lessThan": "b62c510f59803f82f9b4c76ead2a56833b2984c7",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "lessThan": "cfc0b8e5080aec87700774e8568765eaa4b7b92b",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e9cb7be2fcbaee9e808b729e92948d38d52e5add",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate minimum PDU size for transform requests\n\nThe receive path applies the minimum SMB2 PDU size check only when\nProtocolId is SMB2_PROTO_NUMBER. A packet carrying\nSMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated\ndialect does not provide transform handling.\n\nOn an SMB 2.1 connection, a short transform packet therefore reaches\ninit_smb2_rsp_hdr(), which interprets the request as a full SMB2 header\nand reads beyond the request allocation. The copied fields can then be\nreturned to the unauthenticated client.\n\nCompression transforms are converted to ordinary SMB2 messages before\nprotocol validation. After that conversion, validate ordinary SMB2\nrequests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption\ntransform requests to contain both a transform header and an SMB2\nheader. This rejects truncated requests before work allocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the malformed short SMB2_TRANSFORM PDU is delivered entirely as remote network data in ksmbd_conn_handler_loop(), and the leaked bytes are returned in the network response. No local access is involved.\nAC:L - The attacker connects, sends a NEGOTIATE selecting dialect 2.1 (permitted by default since ksmbd_min_protocol() is SMB21_PROT), then a 35-byte packet with ProtocolId 0xFD\u0027SMB\u0027; the undersized-buffer header copy happens deterministically with no race, timing, or memory-layout dependency.\nPR:N - Only NEGOTIATE is required to reach the flaw, which precedes SESSION_SETUP; smb2_check_user_session() fails after the out-of-bounds copy has already been made, so the disclosure is delivered to a fully unauthenticated client.\nUI:N - The attacker drives the entire exchange from a single TCP connection; no action by any local user, administrator, or SMB client is needed.\nS:U - The out-of-bounds read and the disclosed data remain within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - init_smb2_rsp_hdr() reads a 64-byte smb2_hdr out of a ~40-byte kvmalloc allocation and echoes MessageId, ProcessId, TreeId, SessionId and 16 Signature bytes back to the client, disclosing ~28 bytes of uninitialized and adjacent kmalloc-64 heap contents per request, repeatable at will as a remote heap/KASLR oracle.\nI:N - The defect is a read past the request allocation; no attacker-controlled data is written into kernel memory and no kernel or filesystem state is modified by the truncated transform request.\nA:H - The header copy reads past the end of the slab object; on KASAN, hardware tag-based KASAN (MTE), or slub_debug/hardened builds this is a fatal report, and any such unchecked out-of-bounds kernel access is treated as crash-capable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:22.134Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22f1aa35b87e471cc31b35b74451f46630863b12"
        },
        {
          "url": "https://git.kernel.org/stable/c/928dda88d0e13fbca381255028f65b244343a4ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8e5c5672724b8f3c4c099d2cf60239c996e5424"
        },
        {
          "url": "https://git.kernel.org/stable/c/32e486b70c256d5ef4baa5a2936ade2fea50e8eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9e9753dfd43bd27c956578df7804a3c90b80fdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b"
        }
      ],
      "title": "ksmbd: validate minimum PDU size for transform requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68431",
    "datePublished": "2026-08-12T00:07:17.216Z",
    "dateReserved": "2026-07-30T09:28:09.393Z",
    "dateUpdated": "2026-08-23T12:46:22.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7dc306ff7c4d951582adaae65e0aee9fb4968dbe",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "447a37a6bef11bfd3645069e380460b11386e2b9",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "f0831f13c42c1261d449dcee8a035e1c6cd9fcaa",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "013a4484f061a2b41f052e25c0015203287e63f1",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "8fa3e9435a13c335efb63fb4f4e77531a0031159",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "a9ae0f6dd45c3ccc1d69363f7aea8af179122730",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA ECC private key requests\n\ncca_ecc2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the `/dev/pkey` misc device via the PKEY_KBLOB2PROTK/PROTK2/PROTK3 ioctls, requiring local access to the s390 system; there is no remote or network-facing path into cca_ecc2protkey().\nAC:L - The attacker fully controls both the overflow length and the overflowing bytes by crafting the ECC key token\u0027s `len` field and blob contents, and the memcpy executes deterministically on every call with no race, timing, or layout precondition.\nPR:L - The pkey misc device is registered with mode 0666 and pkey_unlocked_ioctl performs no capability check, so any unprivileged local user (or a container/sandbox process with the node visible) can issue the ioctl.\nUI:N - The attacker triggers the overflow entirely from its own ioctl call; no action by another user or administrator is needed.\nS:U - The heap corruption occurs in kernel memory within the same security authority; no VM, IOMMU, or other trust boundary is crossed by the overflow itself.\nC:H - The controlled slab overflow can overwrite adjacent kernel objects (pointers, lengths, credentials) with attacker-chosen data, which is readily leveraged into arbitrary kernel memory disclosure, including protected/secure key material handled by this subsystem.\nI:H - memcpy() writes up to ~7 KB of fully attacker-controlled data past a kmalloc\u0027d CPRB buffer, giving a classic controlled heap out-of-bounds write usable for corrupting neighbouring slab objects and achieving privilege escalation or control-flow hijack.\nA:H - Even without reliable exploitation, the oversized memcpy smashes the slab and neighbouring allocations, causing memory corruption, SLUB/redzone BUG detonations, oops or kernel panic, repeatedly triggerable by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:48.084Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7dc306ff7c4d951582adaae65e0aee9fb4968dbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/447a37a6bef11bfd3645069e380460b11386e2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0831f13c42c1261d449dcee8a035e1c6cd9fcaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730"
        }
      ],
      "title": "s390/zcrypt: Validate length for CCA ECC private key requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68451",
    "datePublished": "2026-08-13T13:59:53.674Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-08-19T16:35:48.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be037204e4f595e4bd2159acda146677a1dc6342",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "4e500ecb6704d879f9c2417c2ed6faba595015ca",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "7f9e5a3dbb14a9b321a1dfa30390402c673f82dc",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "406b317ea2b501f6f5eca1264293c9399a73a778",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "4fc46deceda076d429ef3fab2ccf8d96629ebd23",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "ad93a1f1a45652478c0cf4eb029114e03af57f3b",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "3859f630b674801a00bca39bc451f52288591f65",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "06afe425d5283b9764303de47f554da5a808ce8a",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA AES cipher key requests\n\ncca_cipher2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through an ioctl (PKEY_KBLOB2PROTK2/3) on the /dev/pkey character device, requiring local access to the s390 system; there is no remote or adjacent-network path to cca_cipher2protkey().\nAC:L - The overflow is fully deterministic: the attacker sets the token\u0027s len field to any value up to the 8192-byte ioctl limit and the memcpy into the 512-byte parameter block happens unconditionally, before any crypto card interaction, with no race or unknown state involved.\nPR:L - The pkey misc device is registered with .mode = 0666 and neither pkey_api.c, pkey_base.c nor pkey_cca.c performs any capable()/CAP_* check, so any unprivileged local user can open it and issue the key-to-protkey ioctl.\nUI:N - The attacker triggers the overflow entirely on its own by issuing the ioctl with a crafted CCA AES cipher key token; no victim action or cooperation is needed.\nS:U - The heap corruption occurs in kernel slab memory managed by the same kernel security authority as the calling process; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The controlled slab overflow (up to ~7.6 KB past a kmalloc-2k object) lets the attacker overwrite adjacent kernel objects, and the corrupted CPRB/reply buffer is subsequently parsed and partially copied back to userspace, giving a path to disclosing arbitrary kernel memory.\nI:H - memcpy() writes attacker-chosen token bytes far beyond the 512-byte parameter block, an out-of-bounds heap write with attacker-controlled length and contents, which is a classic primitive for corrupting neighbouring slab objects and hijacking control flow.\nA:H - Overwriting several kilobytes of adjacent slab memory reliably corrupts unrelated kernel objects and slab metadata, causing oopses or a panic; the ioctl can be repeated at will by any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:50.661Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be037204e4f595e4bd2159acda146677a1dc6342"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e500ecb6704d879f9c2417c2ed6faba595015ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f9e5a3dbb14a9b321a1dfa30390402c673f82dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65"
        },
        {
          "url": "https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a"
        }
      ],
      "title": "s390/zcrypt: Validate length for CCA AES cipher key requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68452",
    "datePublished": "2026-08-13T13:59:54.840Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-08-19T16:35:50.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/entry/entry_64.S",
            "arch/x86/include/asm/nospec-branch.h",
            "arch/x86/kernel/cpu/bugs.c",
            "arch/x86/lib/retpoline.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfefa3c51370f84acb643cddf98bb42c885d0483",
              "status": "affected",
              "version": "3f9b7101bea1dcb63410c016ceb266f6e9f733c9",
              "versionType": "git"
            },
            {
              "lessThan": "52db77a13be224e09eb4ba6b4252ae8ab9085c2c",
              "status": "affected",
              "version": "b35087763a44d1eb45857f799579a351332be505",
              "versionType": "git"
            },
            {
              "lessThan": "d0208e08d64d99383e09852a76cc3038c5a4c3ab",
              "status": "affected",
              "version": "ac41e90d8daa8815d8bee774a1975435fbfe1ae7",
              "versionType": "git"
            },
            {
              "lessThan": "6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096",
              "status": "affected",
              "version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
              "versionType": "git"
            },
            {
              "lessThan": "e262f28a69ae9e0791248f93b0173c1d1f3e1d5d",
              "status": "affected",
              "version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
              "versionType": "git"
            },
            {
              "lessThan": "bfe7f9993467ba431b2731437949ac1e2634e771",
              "status": "affected",
              "version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
              "versionType": "git"
            },
            {
              "lessThan": "61649a2d61cb0dbc673f0f232f0f0c298bf50442",
              "status": "affected",
              "version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
              "versionType": "git"
            },
            {
              "lessThan": "7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9",
              "status": "affected",
              "version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "acdc883eb61efbe01b954e782e1124790bd391a8",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.264",
              "status": "affected",
              "version": "5.10.189",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.215",
              "status": "affected",
              "version": "5.15.125",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.182",
              "status": "affected",
              "version": "6.1.44",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/entry/entry_64.S",
            "arch/x86/include/asm/nospec-branch.h",
            "arch/x86/kernel/cpu/bugs.c",
            "arch/x86/lib/retpoline.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.264",
                  "versionStartIncluding": "5.10.189",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.215",
                  "versionStartIncluding": "5.15.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.182",
                  "versionStartIncluding": "6.1.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.150",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.102",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.43",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.7",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Make Safe-RET robust against interrupt injection\n\nAn attacker injecting interrupts while the Safe-RET mitigation executes\non machines affected by SRSO can neutralize the safe return sequence,\npotentially leading to data leakage through speculative execution.\n\nFixup register state as if the Safe-RET sequence executed successfully\nby \"emulating\" it, in a manner of speaking, and avoid executing a RET\ninstruction after returning from the interrupt."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:07.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"
        },
        {
          "url": "https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096"
        },
        {
          "url": "https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771"
        },
        {
          "url": "https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"
        },
        {
          "url": "https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf"
        }
      ],
      "title": "x86/bugs: Make Safe-RET robust against interrupt injection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68480",
    "datePublished": "2026-08-06T17:36:43.654Z",
    "dateReserved": "2026-07-30T09:28:09.397Z",
    "dateUpdated": "2026-08-18T06:56:07.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bde92f65042ec14389782dd223f706bf6b59ce5d",
              "status": "affected",
              "version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
              "versionType": "git"
            },
            {
              "lessThan": "0993dc5fc619c0b25ab1310cb11d65e78351c0fe",
              "status": "affected",
              "version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
              "versionType": "git"
            },
            {
              "lessThan": "5a55f9aecc08990940e70f0c7048a80850c5a16a",
              "status": "affected",
              "version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
              "versionType": "git"
            },
            {
              "lessThan": "5e0b273e0a62cc04ec338c7b502797c66c2ed42a",
              "status": "affected",
              "version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1050727d83e70449991c29dd1cf29fe936a63da3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "27ca3e20fe80be85a92b10064dfeb56cb2564b1c",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register bounds before narrowing retval range in check_mem_access()\n\nWhen the BPF verifier processes a context load of an LSM hook return\nvalue, it calls __mark_reg_s32_range() to narrow the register to the\nhook\u0027s valid range. However, __mark_reg_s32_range() intersects the new\nrange with the register\u0027s existing bounds using max_t()/min_t() rather\nthan replacing them.\n\nIf the destination register carries stale bounds from a prior instruction\n(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than\nreality. The verifier then believes it knows the register\u0027s exact value,\nwhile at runtime the actual hook return value is loaded, creating a\nverifier/runtime mismatch that can be used to bypass BPF memory safety\nchecks.\n\nThe else branch already calls mark_reg_unknown() to reset register state\nbefore any narrowing. Apply the same reset in the is_retval path so\nstale bounds are cleared before __mark_reg_s32_range() intersects."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through bpf(BPF_PROG_LOAD) during bpf_check()-\u003echeck_mem_access() when a BPF_LSM_MAC program loads the LSM hook return value from PTR_TO_CTX; per kernel CNA guidance BPF verifier issues are Local even if attached programs later run on file, socket, or network LSM hooks.\nAC:L - An attacker fully controls the BPF instruction sequence (e.g., BPF_MOV64_IMM to leave stale bounds, then a ctx retval load) and can deterministically force __mark_reg_s32_range() to intersect into an overly narrow range without races, special memory layout, or other uncontrollable conditions.\nPR:L - Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON (is_perfmon_prog_type), both blocked for unprivileged users when kernel.unprivileged_bpf_disabled is set but obtainable inside user namespaces on typical CONFIG_BPF_LSM systems per kernel CNA BPF guidance.\nUI:N - No victim interaction is required; the attacker loads, verifies, and attaches their own malicious BPF LSM program and triggers the attached LSM hook with their own local syscalls or network operations.\nS:C - A container or user-namespace tenant with namespace-granted CAP_BPF can load a verifier-bypassing BPF LSM program whose runtime memory corruption executes in host kernel context on LSM hook firing, crossing the container-to-host security boundary on multi-tenant cloud and Android-style deployments.\nC:H - The verifier/runtime register-bounds mismatch lets unsafe BPF programs pass verification and perform out-of-bounds reads on ctx, stack, or map memory at runtime, a memory-corruption primitive that can be developed into arbitrary kernel memory disclosure.\nI:H - False exact-knowledge of the LSM return-value register enables verifier-approved pointer arithmetic and memory writes that are invalid at runtime, enabling out-of-bounds writes and control-flow hijacking toward arbitrary kernel code execution from BPF context.\nA:H - Running verifier-incorrect BPF LSM programs can trigger kernel oops or panic from corrupted memory accesses, and once attached the attacker can repeatedly invoke the hook to cause repeatable host-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:25.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bde92f65042ec14389782dd223f706bf6b59ce5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0993dc5fc619c0b25ab1310cb11d65e78351c0fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a55f9aecc08990940e70f0c7048a80850c5a16a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e0b273e0a62cc04ec338c7b502797c66c2ed42a"
        }
      ],
      "title": "bpf: Reset register bounds before narrowing retval range in check_mem_access()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72111",
    "datePublished": "2026-08-15T05:52:52.538Z",
    "dateReserved": "2026-08-09T03:40:39.906Z",
    "dateUpdated": "2026-08-17T05:40:25.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1738db550334adca0e7fcf0ef684198fb7462779",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "21976fe5258494ac38b63d103be81bf1180ae4ae",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "5d363d00bc9799b90a0dc89eb1c5dcb909c042ee",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "af80e2bfde9312c76b60cf9274248dce0410b30d",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Wait on external BO kernel fences in exec IOCTL\n\nBefore arming a user job, xe_exec_ioctl() only added the VM\u0027s\ndma-resv KERNEL slot as a dependency. That slot covers rebinds and\nthe kernel operations of the VM\u0027s private BOs, but not external BOs\n(bo-\u003evm == NULL), which carry their kernel operations (evictions,\nmoves, ...) in their own dma-resv KERNEL slot.\n\nThe DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for\nmemory management operations that must complete before the BO or its\nbacking store may be used: any accessor is required to wait on the\nKERNEL fences before touching the resv. By skipping the external BOs\u0027\nKERNEL slots, the exec path violated that contract and could schedule\na user job while a kernel operation on an external BO mapped by the VM\nwas still in flight, racing against it and potentially reading or\nwriting memory that was being moved.\n\nReplace the VM-only dependency with an iteration over every object\nlocked by the exec, adding each object\u0027s KERNEL slot as a job\ndependency. This covers the VM resv (rebinds and private BOs) as well\nas every external BO, mirroring the drm_gpuvm_resv_add_fence() call\nthat later publishes the job fence to the same set of objects.\nLong-running mode continues to skip this, as before.\n\n(cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through DRM_IOCTL_XE_EXEC on an Intel xe render node (/dev/dri/renderD*); xe_exec_ioctl() is the sole entry and there is no network, Bluetooth, or remote protocol path into this dma-resv synchronization code.\nAC:L - An attacker controls both sides: they create external BOs (vm_id=0), bind them into a non-LR VM, drive VRAM pressure to start kernel evictions/moves, and submit concurrent execs, so the missing external-BO KERNEL-fence wait is reliably triggerable without victim-dependent timing.\nPR:L - XE_EXEC is registered DRM_RENDER_ALLOW in xe_device.c, so any unprivileged local user with a render-node fd (typical desktop/Android/ChromeOS GPU clients) can reach xe_exec_ioctl(); no CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - Exploitation is fully self-contained in the attacker\u0027s process via ordinary xe ioctls (GEM create, VM bind, exec queue create, exec); no victim mount, file open, or other cooperative action is needed beyond routine GPU access.\nS:U - The race corrupts GPU buffer backing stores and dma-resv ordering within the same kernel security authority; it does not cross a VM, hypervisor, or IOMMU isolation boundary and matches standard local kernel memory-safety impact rather than sandbox/VM escape.\nC:H - Skipping each external BO\u0027s DMA_RESV_USAGE_KERNEL fence lets a user GPU job run while TTM eviction/move blits are still copying that BO, so the engine can read stale or partially moved physical pages and disclose contents of memory the caller should not observe.\nI:H - The same unsynchronized window lets GPU writes land on a backing store being relocated or on pages whose PTEs no longer match the BO, yielding attacker-influenceable corruption of buffer objects and GPU page-table state usable for privilege escalation primitives.\nA:H - Racing user execs against in-flight kernel BO moves can hang or reset the GPU engine, trip fault handlers, and destabilize the xe driver stack; per kernel CVSS guidance, this class of memory-management race that can panic or wedge the device warrants High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:14.316Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1738db550334adca0e7fcf0ef684198fb7462779"
        },
        {
          "url": "https://git.kernel.org/stable/c/21976fe5258494ac38b63d103be81bf1180ae4ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d363d00bc9799b90a0dc89eb1c5dcb909c042ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/af80e2bfde9312c76b60cf9274248dce0410b30d"
        }
      ],
      "title": "drm/xe: Wait on external BO kernel fences in exec IOCTL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74440",
    "datePublished": "2026-08-15T12:26:48.483Z",
    "dateReserved": "2026-08-15T05:44:03.897Z",
    "dateUpdated": "2026-08-17T05:47:14.316Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b63c680ff605f60f056e5f2c323f1a602aee182",
              "status": "affected",
              "version": "b9aa02ca39a49740926c2c450a1505a4a0f8954a",
              "versionType": "git"
            },
            {
              "lessThan": "07f8aaffee705e552c1f723ac8bf7eb137ad59c2",
              "status": "affected",
              "version": "b9aa02ca39a49740926c2c450a1505a4a0f8954a",
              "versionType": "git"
            },
            {
              "lessThan": "11483d80267db97fbe49f2df66385434256cc3b0",
              "status": "affected",
              "version": "b9aa02ca39a49740926c2c450a1505a4a0f8954a",
              "versionType": "git"
            },
            {
              "lessThan": "3f7b3728dd9011c915cbeaea77274ebe8366550d",
              "status": "affected",
              "version": "b9aa02ca39a49740926c2c450a1505a4a0f8954a",
              "versionType": "git"
            },
            {
              "lessThan": "bc7a0f721123ea260a42f1ded06dab844ba49434",
              "status": "affected",
              "version": "b9aa02ca39a49740926c2c450a1505a4a0f8954a",
              "versionType": "git"
            },
            {
              "lessThan": "7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261",
              "status": "affected",
              "version": "b9aa02ca39a49740926c2c450a1505a4a0f8954a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/ucsi/ucsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix race condition and ordering in port unregistration\n\nA synchronization issue exists during port unregistration where pending\npartner work items can race against workqueue destruction, leading to\nuse-after-free conditions:\n\n  cros_ec_ucsi cros_ec_ucsi.3.auto: error -ETIMEDOUT: PPM init failed\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  RIP: 0010:__queue_work+0x83/0x4a0\n  Call Trace:\n    \u003cIRQ\u003e\n    __cfi_delayed_work_timer_fn+0x10/0x10\n    run_timer_softirq+0x3b6/0xbd0\n    sched_clock_cpu+0xc/0x110\n    irq_exit_rcu+0x18d/0x330\n    fred_sysvec_apic_timer_interrupt+0x5e/0x80\n\nFix this by ensuring strict ordering and proper serialization during\nteardown:\n\n1. Move ucsi_unregister_partner() to the beginning of the teardown\nsequence and protect it under the connector mutex lock.\n2. Ensure all pending partner tasks are explicitly flushed and finished\nbefore the workqueue is destroyed.\n3. Switch from mod_delayed_work() to a cancel_delayed_work() and\nqueue_delayed_work() sequence. This guarantees that items currently marked\nas pending won\u0027t be scheduled an additional time, preventing a double\nrelease of resources which leads to the following crash:\n\n  Oops: general protection fault, probably for non-canonical address\n    0xdead000000000122: 0000 [#1] SMP NOPTI\n  Workqueue: cros_ec_ucsi.3.auto-con2 ucsi_poll_worker\n  RIP: 0010:ucsi_poll_worker+0x65/0x1e0\n  Call Trace:\n  \u003cTASK\u003e\n    process_scheduled_works+0x218/0x6d0\n    worker_thread+0x188/0x3f0\n    __cfi_worker_thread+0x10/0x10\n    kthread+0x226/0x2a0\n\nTo ensure these rules are applied identically across both the normal\nteardown and the ucsi_init() error paths, consolidate the cleanup logic\ninto a new helper, ucsi_unregister_port()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:17.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b63c680ff605f60f056e5f2c323f1a602aee182"
        },
        {
          "url": "https://git.kernel.org/stable/c/07f8aaffee705e552c1f723ac8bf7eb137ad59c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/11483d80267db97fbe49f2df66385434256cc3b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f7b3728dd9011c915cbeaea77274ebe8366550d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc7a0f721123ea260a42f1ded06dab844ba49434"
        },
        {
          "url": "https://git.kernel.org/stable/c/7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261"
        }
      ],
      "title": "usb: typec: ucsi: Fix race condition and ordering in port unregistration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74441",
    "datePublished": "2026-08-15T12:26:49.359Z",
    "dateReserved": "2026-08-15T05:44:03.897Z",
    "dateUpdated": "2026-08-23T12:47:17.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}