Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1090
Vulnerability from certfr_avis - Published: 2026-08-28 - Updated: 2026-08-28
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.105-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-74632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74632"
},
{
"name": "CVE-2026-74452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74452"
},
{
"name": "CVE-2026-74649",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74649"
},
{
"name": "CVE-2026-74441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74441"
},
{
"name": "CVE-2026-68480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68480"
},
{
"name": "CVE-2026-74517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74517"
},
{
"name": "CVE-2026-74450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74450"
},
{
"name": "CVE-2026-74481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74481"
},
{
"name": "CVE-2026-68138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68138"
},
{
"name": "CVE-2026-74597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74597"
},
{
"name": "CVE-2026-74669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74669"
},
{
"name": "CVE-2026-74482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74482"
},
{
"name": "CVE-2026-74598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74598"
},
{
"name": "CVE-2026-74540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74540"
},
{
"name": "CVE-2026-74440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74440"
},
{
"name": "CVE-2026-74502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74502"
},
{
"name": "CVE-2026-53092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53092"
},
{
"name": "CVE-2026-74599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74599"
},
{
"name": "CVE-2026-74569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74569"
},
{
"name": "CVE-2026-74581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
},
{
"name": "CVE-2026-74543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74543"
},
{
"name": "CVE-2026-74696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74696"
},
{
"name": "CVE-2026-74612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74612"
},
{
"name": "CVE-2026-74563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74563"
},
{
"name": "CVE-2026-74457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74457"
},
{
"name": "CVE-2026-74505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74505"
},
{
"name": "CVE-2026-74523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74523"
},
{
"name": "CVE-2026-74453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74453"
},
{
"name": "CVE-2026-74693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74693"
},
{
"name": "CVE-2026-74557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74557"
},
{
"name": "CVE-2026-74607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74607"
},
{
"name": "CVE-2026-74461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74461"
},
{
"name": "CVE-2026-74514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74514"
},
{
"name": "CVE-2026-68132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68132"
},
{
"name": "CVE-2026-74465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74465"
},
{
"name": "CVE-2026-74630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74630"
},
{
"name": "CVE-2026-74682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74682"
},
{
"name": "CVE-2026-74488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74488"
},
{
"name": "CVE-2026-74683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74683"
},
{
"name": "CVE-2025-40054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40054"
},
{
"name": "CVE-2026-74444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74444"
},
{
"name": "CVE-2026-74724",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74724"
},
{
"name": "CVE-2026-74657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74657"
},
{
"name": "CVE-2026-74676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74676"
},
{
"name": "CVE-2026-74460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74460"
},
{
"name": "CVE-2026-74586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74586"
},
{
"name": "CVE-2026-64017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64017"
},
{
"name": "CVE-2026-68276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68276"
},
{
"name": "CVE-2026-74661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74661"
},
{
"name": "CVE-2026-74688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74688"
},
{
"name": "CVE-2026-74572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74572"
},
{
"name": "CVE-2026-74726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74726"
},
{
"name": "CVE-2026-74531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74531"
},
{
"name": "CVE-2026-74549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74549"
},
{
"name": "CVE-2026-68267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68267"
},
{
"name": "CVE-2026-74470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74470"
},
{
"name": "CVE-2026-74478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74478"
},
{
"name": "CVE-2026-74566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74566"
},
{
"name": "CVE-2026-68166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68166"
},
{
"name": "CVE-2026-74473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74473"
},
{
"name": "CVE-2026-74467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74467"
},
{
"name": "CVE-2026-74476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74476"
},
{
"name": "CVE-2026-74691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74691"
},
{
"name": "CVE-2026-74490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74490"
},
{
"name": "CVE-2026-74730",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74730"
},
{
"name": "CVE-2026-68169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68169"
},
{
"name": "CVE-2026-74580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74580"
},
{
"name": "CVE-2026-74565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74565"
},
{
"name": "CVE-2026-74660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74660"
},
{
"name": "CVE-2026-74454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74454"
},
{
"name": "CVE-2026-74493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74493"
},
{
"name": "CVE-2026-74463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74463"
},
{
"name": "CVE-2026-74583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74583"
},
{
"name": "CVE-2026-74725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74725"
},
{
"name": "CVE-2026-74665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74665"
},
{
"name": "CVE-2026-74464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74464"
},
{
"name": "CVE-2026-74636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74636"
},
{
"name": "CVE-2026-74522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74522"
},
{
"name": "CVE-2026-74704",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74704"
},
{
"name": "CVE-2026-74689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74689"
},
{
"name": "CVE-2026-74710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74710"
},
{
"name": "CVE-2026-74622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74622"
},
{
"name": "CVE-2026-74474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74474"
},
{
"name": "CVE-2026-74604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74604"
},
{
"name": "CVE-2026-74451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74451"
},
{
"name": "CVE-2026-74555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74555"
},
{
"name": "CVE-2026-74623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74623"
},
{
"name": "CVE-2026-74456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74456"
},
{
"name": "CVE-2026-74535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74535"
},
{
"name": "CVE-2026-74552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74552"
},
{
"name": "CVE-2026-74714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74714"
},
{
"name": "CVE-2026-74664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74664"
},
{
"name": "CVE-2026-74445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74445"
},
{
"name": "CVE-2026-43197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43197"
},
{
"name": "CVE-2026-74620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74620"
},
{
"name": "CVE-2026-74732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74732"
},
{
"name": "CVE-2026-74499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74499"
},
{
"name": "CVE-2026-74675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74675"
},
{
"name": "CVE-2026-74685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74685"
},
{
"name": "CVE-2026-74701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74701"
},
{
"name": "CVE-2026-74670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74670"
},
{
"name": "CVE-2026-74504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74504"
},
{
"name": "CVE-2026-74637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74637"
},
{
"name": "CVE-2026-74447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74447"
},
{
"name": "CVE-2026-74536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74536"
},
{
"name": "CVE-2026-74589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74589"
},
{
"name": "CVE-2026-74479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74479"
},
{
"name": "CVE-2026-74492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74492"
},
{
"name": "CVE-2026-74641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74641"
},
{
"name": "CVE-2026-68159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68159"
},
{
"name": "CVE-2026-74694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74694"
},
{
"name": "CVE-2026-68367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68367"
},
{
"name": "CVE-2026-74614",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74614"
},
{
"name": "CVE-2026-74442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74442"
},
{
"name": "CVE-2026-68273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68273"
},
{
"name": "CVE-2026-74684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74684"
},
{
"name": "CVE-2026-74608",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74608"
},
{
"name": "CVE-2026-74484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74484"
},
{
"name": "CVE-2026-74459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74459"
},
{
"name": "CVE-2026-74471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74471"
},
{
"name": "CVE-2026-74553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74553"
},
{
"name": "CVE-2026-74671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74671"
},
{
"name": "CVE-2026-74515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74515"
},
{
"name": "CVE-2026-74448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74448"
},
{
"name": "CVE-2026-74592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74592"
},
{
"name": "CVE-2026-64586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64586"
},
{
"name": "CVE-2026-74609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74609"
},
{
"name": "CVE-2026-74487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74487"
},
{
"name": "CVE-2026-74668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74668"
},
{
"name": "CVE-2026-74500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74500"
},
{
"name": "CVE-2026-74618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74618"
},
{
"name": "CVE-2026-74498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74498"
},
{
"name": "CVE-2026-74615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74615"
},
{
"name": "CVE-2026-74524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74524"
},
{
"name": "CVE-2026-74625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74625"
},
{
"name": "CVE-2026-68264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68264"
},
{
"name": "CVE-2026-74446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74446"
},
{
"name": "CVE-2026-74577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74577"
},
{
"name": "CVE-2026-74516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74516"
},
{
"name": "CVE-2026-74590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74590"
},
{
"name": "CVE-2026-74541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74541"
},
{
"name": "CVE-2026-74574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74574"
},
{
"name": "CVE-2026-74567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74567"
},
{
"name": "CVE-2026-74619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74619"
},
{
"name": "CVE-2026-74582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
},
{
"name": "CVE-2026-74519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74519"
},
{
"name": "CVE-2026-74548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74548"
},
{
"name": "CVE-2026-74718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74718"
},
{
"name": "CVE-2026-68118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68118"
},
{
"name": "CVE-2026-74518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74518"
},
{
"name": "CVE-2026-74503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74503"
},
{
"name": "CVE-2026-68322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68322"
},
{
"name": "CVE-2026-74603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74603"
},
{
"name": "CVE-2026-74587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74587"
},
{
"name": "CVE-2026-74663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74663"
},
{
"name": "CVE-2026-74472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74472"
},
{
"name": "CVE-2026-74677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74677"
},
{
"name": "CVE-2026-68082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68082"
},
{
"name": "CVE-2026-74494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74494"
},
{
"name": "CVE-2026-74508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74508"
},
{
"name": "CVE-2026-74672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74672"
},
{
"name": "CVE-2026-74469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74469"
},
{
"name": "CVE-2026-74602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74602"
},
{
"name": "CVE-2026-74483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74483"
},
{
"name": "CVE-2026-74679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74679"
},
{
"name": "CVE-2026-68451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68451"
},
{
"name": "CVE-2026-74717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74717"
},
{
"name": "CVE-2026-74700",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74700"
},
{
"name": "CVE-2026-74610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74610"
},
{
"name": "CVE-2026-74655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74655"
},
{
"name": "CVE-2026-74654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74654"
},
{
"name": "CVE-2026-74658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74658"
},
{
"name": "CVE-2026-74576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74576"
},
{
"name": "CVE-2026-74546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74546"
},
{
"name": "CVE-2026-74680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74680"
},
{
"name": "CVE-2026-74497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74497"
},
{
"name": "CVE-2026-74510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
},
{
"name": "CVE-2026-74455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74455"
},
{
"name": "CVE-2026-74512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74512"
},
{
"name": "CVE-2026-74646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74646"
},
{
"name": "CVE-2026-74588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74588"
},
{
"name": "CVE-2026-68266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68266"
},
{
"name": "CVE-2026-74556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
},
{
"name": "CVE-2026-74532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74532"
},
{
"name": "CVE-2026-74595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74595"
},
{
"name": "CVE-2026-68452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68452"
},
{
"name": "CVE-2026-74692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74692"
},
{
"name": "CVE-2026-74719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74719"
},
{
"name": "CVE-2026-74585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74585"
},
{
"name": "CVE-2026-74651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74651"
},
{
"name": "CVE-2026-74551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74551"
},
{
"name": "CVE-2026-74666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74666"
},
{
"name": "CVE-2026-74705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74705"
},
{
"name": "CVE-2026-68431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68431"
},
{
"name": "CVE-2026-74495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74495"
},
{
"name": "CVE-2026-72111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72111"
},
{
"name": "CVE-2026-68254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68254"
},
{
"name": "CVE-2026-74720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74720"
},
{
"name": "CVE-2026-74547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74547"
},
{
"name": "CVE-2026-74579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74579"
},
{
"name": "CVE-2026-74458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74458"
},
{
"name": "CVE-2026-74647",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74647"
},
{
"name": "CVE-2026-74613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74613"
},
{
"name": "CVE-2026-74525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74525"
},
{
"name": "CVE-2026-74594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74594"
},
{
"name": "CVE-2026-74475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74475"
},
{
"name": "CVE-2026-74659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74659"
},
{
"name": "CVE-2026-68253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68253"
},
{
"name": "CVE-2026-74621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74621"
},
{
"name": "CVE-2025-38525",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38525"
},
{
"name": "CVE-2026-74507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74507"
},
{
"name": "CVE-2026-74606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74606"
},
{
"name": "CVE-2026-74628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74628"
},
{
"name": "CVE-2026-74667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74667"
},
{
"name": "CVE-2026-74601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74601"
},
{
"name": "CVE-2026-74673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74673"
},
{
"name": "CVE-2026-74722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74722"
},
{
"name": "CVE-2026-68198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68198"
},
{
"name": "CVE-2026-74635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74635"
},
{
"name": "CVE-2026-74624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74624"
},
{
"name": "CVE-2026-74678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74678"
},
{
"name": "CVE-2026-74575",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74575"
},
{
"name": "CVE-2026-74480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74480"
},
{
"name": "CVE-2026-74545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74545"
},
{
"name": "CVE-2026-74468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74468"
},
{
"name": "CVE-2026-74631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74631"
},
{
"name": "CVE-2026-74634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74634"
},
{
"name": "CVE-2026-74644",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74644"
},
{
"name": "CVE-2026-74485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74485"
},
{
"name": "CVE-2026-74564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74564"
},
{
"name": "CVE-2026-74616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74616"
},
{
"name": "CVE-2026-74712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74712"
},
{
"name": "CVE-2026-74550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74550"
},
{
"name": "CVE-2026-74509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74509"
},
{
"name": "CVE-2026-74656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74656"
},
{
"name": "CVE-2026-74648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74648"
},
{
"name": "CVE-2026-74650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74650"
},
{
"name": "CVE-2026-74443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74443"
},
{
"name": "CVE-2026-74501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74501"
}
],
"initial_release_date": "2026-08-28T00:00:00",
"last_revision_date": "2026-08-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1090",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-28T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-08-25",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00377",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00377.html"
}
]
}
CVE-2026-74453 (GCVE-0-2026-74453)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
drm/vc4: Zero the tile state data array before each BIN job
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Zero the tile state data array before each BIN job
The binner BO is a single 16MB buffer split into 512KB slots that are
handed out to jobs at submission time and recycled as jobs complete,
without ever being cleared. Each slot holds the job's Tile State Data
Array (TSDA) at its start, followed by the tile allocation pool.
While the tile allocation pool is only walked by the render thread
through branches the binner generated during the current job, the
TSDA is the PTB's own per-tile bookkeeping and is consumed by the
hardware itself. Although the kernel sets the "Auto-initialise Tile
State Data Array" flag in the tile binning mode configuration, the
PTB demonstrably still acts on stale tile state left by the slot's
previous user: the binner ends up creating invalid command streams
with invalid primitive streams and branches, which can cause GPU hangs
as observed in [1][2].
Zero the TSDA when the job's binning slot is configured. This clears
48 bytes per tile (~24KB for a 1080p frame) in the submission path, and
guarantees the PTB never sees another job's tile state.
The tile count is only checked for being non-zero today, so the 8-bit
fields it comes from can describe a tile state array almost six times
larger than the slot it has to live in. Bound it before the slot is
handed out, since such size decides how much of the slot is left for
the tile alloc pool.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea
(git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < d3677372e0275e139f0efd2872c5a524b5d12868 (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < c8dea7e7c6098e383e44f21a64d0431da5480e3f (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < f5802be65535f8818af7191159cf8c11f48ab2a2 (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 0e858422df2334165293ea742da9fbb2e51f2739 (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 57667eb7548faaac396c6e39f3b4444dab5b097c (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < a75c8f365e209aa9bb927b0942a7840152d44892 (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 48a570c964d8e37d353381e4195106277e17f5cb (git) |
|
| Linux | Linux |
Affected:
4.13
Unaffected: 0 , < 4.13 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_validate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "d3677372e0275e139f0efd2872c5a524b5d12868",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "c8dea7e7c6098e383e44f21a64d0431da5480e3f",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "f5802be65535f8818af7191159cf8c11f48ab2a2",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "0e858422df2334165293ea742da9fbb2e51f2739",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "57667eb7548faaac396c6e39f3b4444dab5b097c",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "a75c8f365e209aa9bb927b0942a7840152d44892",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "48a570c964d8e37d353381e4195106277e17f5cb",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_validate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Zero the tile state data array before each BIN job\n\nThe binner BO is a single 16MB buffer split into 512KB slots that are\nhanded out to jobs at submission time and recycled as jobs complete,\nwithout ever being cleared. Each slot holds the job\u0027s Tile State Data\nArray (TSDA) at its start, followed by the tile allocation pool.\n\nWhile the tile allocation pool is only walked by the render thread\nthrough branches the binner generated during the current job, the\nTSDA is the PTB\u0027s own per-tile bookkeeping and is consumed by the\nhardware itself. Although the kernel sets the \"Auto-initialise Tile\nState Data Array\" flag in the tile binning mode configuration, the\nPTB demonstrably still acts on stale tile state left by the slot\u0027s\nprevious user: the binner ends up creating invalid command streams\nwith invalid primitive streams and branches, which can cause GPU hangs\nas observed in [1][2].\n\nZero the TSDA when the job\u0027s binning slot is configured. This clears\n48 bytes per tile (~24KB for a 1080p frame) in the submission path, and\nguarantees the PTB never sees another job\u0027s tile state.\n\nThe tile count is only checked for being non-zero today, so the 8-bit\nfields it comes from can describe a tile state array almost six times\nlarger than the slot it has to live in. Bound it before the slot is\nhanded out, since such size decides how much of the slot is left for\nthe tile alloc pool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached in validate_tile_binning_config() while validating a user bin command list during DRM_IOCTL_VC4_SUBMIT_CL on the VC4 DRM render node (/dev/dri/renderD*), a local ioctl path rather than any network-facing protocol.\nAC:L - An attacker with render-node access controls TILE_BINNING_MODE_CONFIG tile dimensions and can submit concurrent or back-to-back bin jobs to obtain recycled 512KB binner slots carrying stale TSDA; no uncontrollable races or rare kernel config are required.\nPR:L - VC4_SUBMIT_CL is registered with DRM_RENDER_ALLOW only (no DRM_AUTH) and vc4_open() performs no capability checks; unprivileged users in the render/video group on Raspberry Pi and other VC4 deployments routinely open /dev/dri/renderD*.\nUI:N - No victim interaction is needed when a local attacker with render-node access crafts and submits a malicious bin command list via DRM_IOCTL_VC4_SUBMIT_CL to trigger recycled-slot stale tile state or oversized tile counts.\nS:U - Impact is stale-state and GPU PTB misbehavior corrupting shared CMA binner memory for local privilege escalation; it does not cross VM, hypervisor, or IOMMU boundaries and remains within the kernel security authority.\nC:H - Recycled 512KB slots retain prior jobs\u0027 48-byte-per-tile TSDA in the shared 16MB CMA binner BO (cross-process GPU address/metadata leak); missing tile-count bounds let the PTB consume up to ~3MB TSDA spanning multiple slots and stale pointers misdirect PTB reads.\nI:H - Stale TSDA drives the PTB to build invalid primitive streams and branches with out-of-slot GPU DMA across the shared binner BO; unbounded 8-bit tile counts also make tile_alloc_size wrap to ~4GB while tile_alloc_offset points past the 512KB slot, enabling arbitrary CMA corruption.\nA:H - The fix commit and linked Raspberry Pi issues document GPU hangs, repeated \"[drm] Resetting GPU\", permanently wedged GPUs after invalid bin streams, display corruption, and full system lockups requiring power-cycle or reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:43.715Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea"
},
{
"url": "https://git.kernel.org/stable/c/d3677372e0275e139f0efd2872c5a524b5d12868"
},
{
"url": "https://git.kernel.org/stable/c/c8dea7e7c6098e383e44f21a64d0431da5480e3f"
},
{
"url": "https://git.kernel.org/stable/c/f5802be65535f8818af7191159cf8c11f48ab2a2"
},
{
"url": "https://git.kernel.org/stable/c/0e858422df2334165293ea742da9fbb2e51f2739"
},
{
"url": "https://git.kernel.org/stable/c/57667eb7548faaac396c6e39f3b4444dab5b097c"
},
{
"url": "https://git.kernel.org/stable/c/a75c8f365e209aa9bb927b0942a7840152d44892"
},
{
"url": "https://git.kernel.org/stable/c/48a570c964d8e37d353381e4195106277e17f5cb"
}
],
"title": "drm/vc4: Zero the tile state data array before each BIN job",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74453",
"datePublished": "2026-08-15T12:26:56.949Z",
"dateReserved": "2026-08-15T05:44:03.899Z",
"dateUpdated": "2026-08-19T16:36:43.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74454 (GCVE-0-2026-74454)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
vc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB
binner BO, but writes the size of the whole BO to BPOS. On every binner
out-of-memory event the PTB is therefore authorized to write tile lists
across all the other slots (which may hold the tile state, tile alloc and
overflow memory of in-flight jobs) and, for any slot but the first, past
the end of the binner BO into unrelated CMA memory.
Since CMA pages are recycled into page cache and user allocations, this
is arbitrary memory corruption by GPU DMA. In practice it shows up as GPU
hangs with corrupted control list pointers, userspace heap corruption, a
GPU that stays permanently wedged after the first hang, and occasional
full system crashes, whenever a job overflows the initial binner slot.
The bug dates back to the conversion from a dedicated overflow BO (where
writing the full BO size was correct) to the slotted binner BO.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < bb5656ae063f2711f56438cf2f1f5b613aea5f12
(git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 2f2291a119e9a8b696ae8bb36e86b75d272ceaea (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 0badb30871004d34df87be33e853536f0b69885f (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 6cd5acf6f87c073622bd61e38fe99c47365cda9c (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 1e33ca7f44be64beed2735bb76b86eb65ba8c05b (git) Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 6395789e4739aa5177bbec0fa0f07ccc38d249b0 (git) |
|
| Linux | Linux |
Affected:
4.13
Unaffected: 0 , < 4.13 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_irq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb5656ae063f2711f56438cf2f1f5b613aea5f12",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "2f2291a119e9a8b696ae8bb36e86b75d272ceaea",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "0badb30871004d34df87be33e853536f0b69885f",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "6cd5acf6f87c073622bd61e38fe99c47365cda9c",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "1e33ca7f44be64beed2735bb76b86eb65ba8c05b",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "6395789e4739aa5177bbec0fa0f07ccc38d249b0",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_irq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\n\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\n\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\n\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires submitting crafted GPU jobs through the VC4 DRM render node via DRM_IOCTL_VC4_SUBMIT_CL; the bug is reached in vc4_overflow_mem_work() after hardware raises V3D_INT_OUTOMEM, which is a local ioctl/syscall path, not a network protocol.\nAC:L - An attacker with render-node access can reliably trigger binner out-of-memory by submitting dense geometry that exhausts the 32-byte initial per-bin allocation, and can run concurrent jobs to force non-zero overflow slots; no race or rare layout conditions beyond attacker-controlled GPU workloads are required.\nPR:L - VC4_SUBMIT_CL is permitted on DRM render nodes (DRM_RENDER_ALLOW, no DRM_AUTH) and vc4_open() performs no extra capability checks; on Raspberry Pi and similar VC4 deployments, unprivileged users in the render/video group routinely have /dev/dri/renderD* access to reach this path.\nUI:N - No victim interaction is required when the attacker is a local unprivileged user with render-node access who directly opens /dev/dri/renderD* and submits a malicious binning command list designed to overflow the initial binner slot.\nS:U - The flaw causes GPU DMA to corrupt CMA memory used by the kernel and userspace, enabling standard local privilege escalation; it does not cross a VM, IOMMU, or hypervisor security boundary and stays within the kernel\u0027s security authority.\nC:H - On OUTOMEM, the driver programs BPOA to a 512KB slot but BPOS to the full 16MB BO, authorizing the PTB to DMA-write far beyond the slot into adjacent in-flight job data and unrelated CMA pages recycled into page cache and user allocations, enabling arbitrary kernel memory disclosure.\nI:H - The oversized BPOS grants the GPU PTB an out-of-bounds DMA write primitive across other binner slots and past the 16MB BO boundary into unrelated CMA memory, corrupting kernel structures and userspace heaps in ways suitable for arbitrary code execution and privilege escalation.\nA:H - The commit reports that triggering binner overflow causes GPU hangs with corrupted control-list pointers, permanently wedged GPUs after the first hang, userspace heap corruption, and occasional full system crashes, satisfying high availability impact from repeatable kernel/GPU failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:46.319Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12"
},
{
"url": "https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea"
},
{
"url": "https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f"
},
{
"url": "https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c"
},
{
"url": "https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b"
},
{
"url": "https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0"
}
],
"title": "drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74454",
"datePublished": "2026-08-15T12:26:57.565Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:46.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74455 (GCVE-0-2026-74455)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: peak_usb: validate uCAN receive record lengths
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: peak_usb: validate uCAN receive record lengths
pcan_usb_fd_decode_buf() walks uCAN records packed in one USB
receive buffer.
Require each record to contain the fixed header for its type, and verify
CAN payload bytes before copying them into the skb.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0a25e1f4f18566b750ebd3ae995af64e23111e63 , < 276d989cd2dd88e2b7ab2c96fd10c86836b12781
(git)
Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < bf9d787b7e1ef59be19b35abca08194772deb97e (git) Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < 89c92a8052698dbbd3652a77c04d02bbd74a3275 (git) Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < 6067c878e38d02a3d5c43497347e143f85c9064a (git) Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < 2c8f08f3641a074da40acf05baa5a18ae2739260 (git) Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < 2427ef427bdd78d862c7c76597bfd9eda88b81f1 (git) Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < d9c115948c3dd5fcc2d0245cec5eb76c098503c8 (git) Affected: 0a25e1f4f18566b750ebd3ae995af64e23111e63 , < 93fcab2c6968446316bbb49548848df604d6346f (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_fd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "276d989cd2dd88e2b7ab2c96fd10c86836b12781",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "bf9d787b7e1ef59be19b35abca08194772deb97e",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "89c92a8052698dbbd3652a77c04d02bbd74a3275",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "6067c878e38d02a3d5c43497347e143f85c9064a",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "2c8f08f3641a074da40acf05baa5a18ae2739260",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "2427ef427bdd78d862c7c76597bfd9eda88b81f1",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "d9c115948c3dd5fcc2d0245cec5eb76c098503c8",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
},
{
"lessThan": "93fcab2c6968446316bbb49548848df604d6346f",
"status": "affected",
"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_fd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: validate uCAN receive record lengths\n\npcan_usb_fd_decode_buf() walks uCAN records packed in one USB\nreceive buffer.\n\nRequire each record to contain the fixed header for its type, and verify\nCAN payload bytes before copying them into the skb."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:48.775Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/276d989cd2dd88e2b7ab2c96fd10c86836b12781"
},
{
"url": "https://git.kernel.org/stable/c/bf9d787b7e1ef59be19b35abca08194772deb97e"
},
{
"url": "https://git.kernel.org/stable/c/89c92a8052698dbbd3652a77c04d02bbd74a3275"
},
{
"url": "https://git.kernel.org/stable/c/6067c878e38d02a3d5c43497347e143f85c9064a"
},
{
"url": "https://git.kernel.org/stable/c/2c8f08f3641a074da40acf05baa5a18ae2739260"
},
{
"url": "https://git.kernel.org/stable/c/2427ef427bdd78d862c7c76597bfd9eda88b81f1"
},
{
"url": "https://git.kernel.org/stable/c/d9c115948c3dd5fcc2d0245cec5eb76c098503c8"
},
{
"url": "https://git.kernel.org/stable/c/93fcab2c6968446316bbb49548848df604d6346f"
}
],
"title": "can: peak_usb: validate uCAN receive record lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74455",
"datePublished": "2026-08-15T12:26:58.175Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:48.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74456 (GCVE-0-2026-74456)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()
and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also
frees the transfer buffer.
If usb_submit_urb() fails, the error path frees the buffer explicitly with
kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,
usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double
free of the transfer buffer.
BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0
Free of addr ffff8881069ccb80 by task trigger.sh/285
Call Trace:
kfree+0x113/0x3c0
usb_free_urb.part.0+0x91/0xb0
Drop the redundant kfree(buf); usb_free_urb() already releases the transfer
buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free
issue with interrupt buffer allocation").
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 914c3b8fa175acf8476ad31cf04e308638e3578e
(git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 5f2fa5840c34d3a558c57855781be75e03bef752 (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < b9088d581fff971a7eb1628f8dcc30df6cfef4dc (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 525640b93d3e5f82f4ebea4730f4e0cf799522ba (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 4bb3325075138dd5346b71589a959878b564dc0b (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 92d0de80ca2223b9c7da78020155b6cb27824cc0 (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < dfb17bf04a764462000f11258a7c06aa92d1f261 (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9 (git) |
|
| Linux | Linux |
Affected:
3.4
Unaffected: 0 , < 3.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "914c3b8fa175acf8476ad31cf04e308638e3578e",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "5f2fa5840c34d3a558c57855781be75e03bef752",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "b9088d581fff971a7eb1628f8dcc30df6cfef4dc",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "525640b93d3e5f82f4ebea4730f4e0cf799522ba",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "4bb3325075138dd5346b71589a959878b564dc0b",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "92d0de80ca2223b9c7da78020155b6cb27824cc0",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "dfb17bf04a764462000f11258a7c06aa92d1f261",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -\u003e urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n Call Trace:\n kfree+0x113/0x3c0\n usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is only reached when a privileged local actor brings the PEAK CAN netdev up via rtnetlink/ioctl (peak_usb_ndo_open\u2192peak_usb_start); CAN-bus traffic and remote protocols never call this setup path, but the entry is a local syscall rather than USB packet processing.\nAC:L - Any usb_submit_urb() failure on RX setup deterministically hits the broken error path; an attacker can reliably force -ENODEV/-ENOENT by disconnecting/resetting the adapter or presenting a rogue PEAK-class gadget while repeatedly running ip link set canX up/down.\nPR:L - Bringing the CAN interface up requires CAP_NET_ADMIN on RTM_SETLINK (rtnl_setlink/netif_open), which is Low under CNA guidance; on automotive/industrial diagnostic hosts this is commonly held by technician/service accounts even though unauthenticated remote attackers cannot reach the path.\nUI:N - No separate victim interaction is needed beyond the attacker (or their malware) issuing the privileged link-up that enters peak_usb_start; they can also script repeated up/down cycles while manipulating USB state themselves.\nS:U - The double-free corrupts host kernel kmalloc slab state within the peak_usb driver scope and does not by itself cross a security boundary such as VM escape, container breakout, or IOMMU bypass.\nC:H - This is a kmalloc RX-buffer double-free with URB_FREE_BUFFER set; per CNA guidance such heap double-free/UAF-class bugs enable controlled reallocation and arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Freeing the same 64\u20132048 byte RX slab object twice corrupts SLUB freelist/metadata and provides a standard heap corruption primitive that can be groomed into arbitrary kernel writes or control-flow hijacking.\nA:H - KASAN already reports a double-free in usb_free_urb() on this path; even without full exploitation, allocator corruption typically causes kernel BUG/oops/panic and repeated trigger cycles can deny CAN/USB service on shared diagnostic systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:51.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e"
},
{
"url": "https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752"
},
{
"url": "https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc"
},
{
"url": "https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba"
},
{
"url": "https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b"
},
{
"url": "https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0"
},
{
"url": "https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261"
},
{
"url": "https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9"
}
],
"title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74456",
"datePublished": "2026-08-15T12:26:58.808Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:51.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74457 (GCVE-0-2026-74457)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: peak_usb: add bounds check for USB channel index
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: peak_usb: add bounds check for USB channel index
The channel control index ctrl_idx is derived from rx->len which comes
directly from a device USB payload. The mask 0x0f allows values 0-15, but
the array size of usb_if->dev[] is only 2. Values 2-15 cause heap
out-of-bounds read, eventually causing kernel panic in the IRQ context.
Add bounds checking for ctrl_idx before the array access in both
pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 18b1a868a2cda66fb438007ba47ce5f2484db381
(git)
Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 0c9268457bd6e4058fe55b4db01b16661c2eacf5 (git) Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 94fb6fe83ce152532b11b36730b30f3dc0c94217 (git) Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f (git) Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < f97b7e5e1cdaae15cd95b3a360028c7929664969 (git) Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 1acab790b7cecd4e144d1d18bdfe549e282f6b0b (git) Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 0149fdb50a30944827acf9600a2cc44de0325a7f (git) Affected: d8a199355f8f8a0797c00d98788d7282c9ea38bd , < 39132f166ca8ce00ae60d8a9068e06a60943cc4b (git) |
|
| Linux | Linux |
Affected:
3.4
Unaffected: 0 , < 3.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_pro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18b1a868a2cda66fb438007ba47ce5f2484db381",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "0c9268457bd6e4058fe55b4db01b16661c2eacf5",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "94fb6fe83ce152532b11b36730b30f3dc0c94217",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "f97b7e5e1cdaae15cd95b3a360028c7929664969",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "1acab790b7cecd4e144d1d18bdfe549e282f6b0b",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "0149fdb50a30944827acf9600a2cc44de0325a7f",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
},
{
"lessThan": "39132f166ca8ce00ae60d8a9068e06a60943cc4b",
"status": "affected",
"version": "d8a199355f8f8a0797c00d98788d7282c9ea38bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_pro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: add bounds check for USB channel index\n\nThe channel control index ctrl_idx is derived from rx-\u003elen which comes\ndirectly from a device USB payload. The mask 0x0f allows values 0-15, but\nthe array size of usb_if-\u003edev[] is only 2. Values 2-15 cause heap\nout-of-bounds read, eventually causing kernel panic in the IRQ context.\n\nAdd bounds checking for ctrl_idx before the array access in both\npcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:52.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18b1a868a2cda66fb438007ba47ce5f2484db381"
},
{
"url": "https://git.kernel.org/stable/c/0c9268457bd6e4058fe55b4db01b16661c2eacf5"
},
{
"url": "https://git.kernel.org/stable/c/94fb6fe83ce152532b11b36730b30f3dc0c94217"
},
{
"url": "https://git.kernel.org/stable/c/825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f"
},
{
"url": "https://git.kernel.org/stable/c/f97b7e5e1cdaae15cd95b3a360028c7929664969"
},
{
"url": "https://git.kernel.org/stable/c/1acab790b7cecd4e144d1d18bdfe549e282f6b0b"
},
{
"url": "https://git.kernel.org/stable/c/0149fdb50a30944827acf9600a2cc44de0325a7f"
},
{
"url": "https://git.kernel.org/stable/c/39132f166ca8ce00ae60d8a9068e06a60943cc4b"
}
],
"title": "can: peak_usb: add bounds check for USB channel index",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74457",
"datePublished": "2026-08-15T12:26:59.411Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:52.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74458 (GCVE-0-2026-74458)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.
Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
080f40a6fa28dab299da7a652e444b1e2d9231e7 , < c00ec53d7dec08134e97071850cc00ef000c5b77
(git)
Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < d9e91672526ffa279709b15490118aea1bdee714 (git) Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < 72f96c2942f11a0ae8663adcb3d9ee986e07d4fa (git) Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < 695aea154bb2d453e6daada1510972fafd075285 (git) Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < 3d0897ec623e422695d70d80ae456f89476c5328 (git) Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < 185cb1fa38142a3cbf223dd8b3abb24217f330d3 (git) Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < 21f0465fd86d77794aaed8e05f833634f68d178d (git) Affected: 080f40a6fa28dab299da7a652e444b1e2d9231e7 , < 0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c00ec53d7dec08134e97071850cc00ef000c5b77",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "d9e91672526ffa279709b15490118aea1bdee714",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "72f96c2942f11a0ae8663adcb3d9ee986e07d4fa",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "695aea154bb2d453e6daada1510972fafd075285",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "3d0897ec623e422695d70d80ae456f89476c5328",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "185cb1fa38142a3cbf223dd8b3abb24217f330d3",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "21f0465fd86d77794aaed8e05f833634f68d178d",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents\n\nThe wait and bulk receive paths walk variable-length commands from a\nUSB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be\ndispatched, and the wait path copies a matching command into a fixed\ncaller-owned struct kvaser_cmd using the device-provided length.\n\nReject nonzero commands that do not contain the fixed header or that\nextend beyond the current USB buffer item. In the wait path, also reject\na matching command that exceeds the destination before copying it."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:54.341Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77"
},
{
"url": "https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714"
},
{
"url": "https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa"
},
{
"url": "https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285"
},
{
"url": "https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328"
},
{
"url": "https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3"
},
{
"url": "https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d"
},
{
"url": "https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee"
}
],
"title": "can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74458",
"datePublished": "2026-08-15T12:27:00.053Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:54.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74459 (GCVE-0-2026-74459)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
es58x_read_bulk_callback() resubmits the RX URB after processing a received
packet. If the resubmit succeeds, the URB remains anchored and will be
handled by the normal RX path or by teardown.
However, if usb_submit_urb() fails, the callback unanchors the URB and then
returns directly. This skips the existing free_urb path, so the coherent
transfer buffer allocated with usb_alloc_coherent() is not released.
Reuse the existing free_urb path after a resubmit failure so that the RX
coherent buffer is freed before leaving the callback.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7a0171b4921ad443fee5ed4fcb9d99fa4776edac , < c7ddf119544eea2d8409e12471c3f9f36ca02e3f
(git)
Affected: 2185ea6e4ebcb61d1224dc7d187c59723cb5ad59 , < 21da1a374769751546cc131e58a4d8bd968f57b2 (git) Affected: f6e90c113c92e83fc0963d5e60e16b0e8a268981 , < 0ef136ba052101243ba117a1aca6f4a4c3a81142 (git) Affected: b878444519fa03a3edd287d1963cf79ef78be2f1 , < b85e5c310382803d27adf6fe6554d4208bc8951c (git) Affected: 18eee279e9b5bff0db1aca9475ae4bc12804f05c , < c311f17c261fd375ddf5755f2ebe1f022c19c5b0 (git) Affected: 5eaad4f768266f1f17e01232ffe2ef009f8129b7 , < 19c6c8c6cd5dd14fab5fcd744584812a57cbb78d (git) Affected: 5eaad4f768266f1f17e01232ffe2ef009f8129b7 , < 7a0cf2b2497c757c3cb1286eddf2986abb0d387b (git) Affected: b8f9ca88253574638bcff38900a4c28d570b1919 (git) Affected: 5.15.203 , < 5.15.216 (semver) Affected: 6.1.167 , < 6.1.183 (semver) Affected: 6.6.130 , < 6.6.151 (semver) Affected: 6.12.77 , < 6.12.103 (semver) Affected: 6.18.17 , < 6.18.44 (semver) Affected: 6.19.7 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/etas_es58x/es58x_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7ddf119544eea2d8409e12471c3f9f36ca02e3f",
"status": "affected",
"version": "7a0171b4921ad443fee5ed4fcb9d99fa4776edac",
"versionType": "git"
},
{
"lessThan": "21da1a374769751546cc131e58a4d8bd968f57b2",
"status": "affected",
"version": "2185ea6e4ebcb61d1224dc7d187c59723cb5ad59",
"versionType": "git"
},
{
"lessThan": "0ef136ba052101243ba117a1aca6f4a4c3a81142",
"status": "affected",
"version": "f6e90c113c92e83fc0963d5e60e16b0e8a268981",
"versionType": "git"
},
{
"lessThan": "b85e5c310382803d27adf6fe6554d4208bc8951c",
"status": "affected",
"version": "b878444519fa03a3edd287d1963cf79ef78be2f1",
"versionType": "git"
},
{
"lessThan": "c311f17c261fd375ddf5755f2ebe1f022c19c5b0",
"status": "affected",
"version": "18eee279e9b5bff0db1aca9475ae4bc12804f05c",
"versionType": "git"
},
{
"lessThan": "19c6c8c6cd5dd14fab5fcd744584812a57cbb78d",
"status": "affected",
"version": "5eaad4f768266f1f17e01232ffe2ef009f8129b7",
"versionType": "git"
},
{
"lessThan": "7a0cf2b2497c757c3cb1286eddf2986abb0d387b",
"status": "affected",
"version": "5eaad4f768266f1f17e01232ffe2ef009f8129b7",
"versionType": "git"
},
{
"status": "affected",
"version": "b8f9ca88253574638bcff38900a4c28d570b1919",
"versionType": "git"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThan": "6.1.183",
"status": "affected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThan": "6.12.103",
"status": "affected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThan": "6.18.44",
"status": "affected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/etas_es58x/es58x_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.1.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.12.77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.18.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure\n\nes58x_read_bulk_callback() resubmits the RX URB after processing a received\npacket. If the resubmit succeeds, the URB remains anchored and will be\nhandled by the normal RX path or by teardown.\n\nHowever, if usb_submit_urb() fails, the callback unanchors the URB and then\nreturns directly. This skips the existing free_urb path, so the coherent\ntransfer buffer allocated with usb_alloc_coherent() is not released.\n\nReuse the existing free_urb path after a resubmit failure so that the RX\ncoherent buffer is freed before leaving the callback."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:55.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7ddf119544eea2d8409e12471c3f9f36ca02e3f"
},
{
"url": "https://git.kernel.org/stable/c/21da1a374769751546cc131e58a4d8bd968f57b2"
},
{
"url": "https://git.kernel.org/stable/c/0ef136ba052101243ba117a1aca6f4a4c3a81142"
},
{
"url": "https://git.kernel.org/stable/c/b85e5c310382803d27adf6fe6554d4208bc8951c"
},
{
"url": "https://git.kernel.org/stable/c/c311f17c261fd375ddf5755f2ebe1f022c19c5b0"
},
{
"url": "https://git.kernel.org/stable/c/19c6c8c6cd5dd14fab5fcd744584812a57cbb78d"
},
{
"url": "https://git.kernel.org/stable/c/7a0cf2b2497c757c3cb1286eddf2986abb0d387b"
}
],
"title": "can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74459",
"datePublished": "2026-08-15T12:27:00.653Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:55.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74460 (GCVE-0-2026-74460)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: ems_usb: validate CPC message lengths
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: ems_usb: validate CPC message lengths
ems_usb_read_bulk_callback() walks CPC messages packed in one USB
receive buffer.
Check that each declared message fits in the URB payload. Also require the
type-specific payload to cover the fields used by the CAN, state, error and
overrun handlers.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
702171adeed3607ee9603ec30ce081411e36ae42 , < bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6
(git)
Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < db5655287d78f00daf98888a520bb8da4d30126d (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < ce8125566b1d0b0f16449407e014addf451804ea (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 0b9090717c7e2184e2c427bbcc752f295116ac1d (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 0b23144c59c126beb4a7761a85a194ae0fe668a5 (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < df3ac2a672a5284441f120d486acabdd6740fc2a (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 02925f51377f2a42a6724f00549167499c9302e5 (git) |
|
| Linux | Linux |
Affected:
2.6.32
Unaffected: 0 , < 2.6.32 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ems_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "db5655287d78f00daf98888a520bb8da4d30126d",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "ce8125566b1d0b0f16449407e014addf451804ea",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "0b9090717c7e2184e2c427bbcc752f295116ac1d",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "0b23144c59c126beb4a7761a85a194ae0fe668a5",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "df3ac2a672a5284441f120d486acabdd6740fc2a",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "02925f51377f2a42a6724f00549167499c9302e5",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ems_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ems_usb: validate CPC message lengths\n\nems_usb_read_bulk_callback() walks CPC messages packed in one USB\nreceive buffer.\n\nCheck that each declared message fits in the URB payload. Also require the\ntype-specific payload to cover the fields used by the CAN, state, error and\noverrun handlers."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:57.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6"
},
{
"url": "https://git.kernel.org/stable/c/db5655287d78f00daf98888a520bb8da4d30126d"
},
{
"url": "https://git.kernel.org/stable/c/ce8125566b1d0b0f16449407e014addf451804ea"
},
{
"url": "https://git.kernel.org/stable/c/0b9090717c7e2184e2c427bbcc752f295116ac1d"
},
{
"url": "https://git.kernel.org/stable/c/0b23144c59c126beb4a7761a85a194ae0fe668a5"
},
{
"url": "https://git.kernel.org/stable/c/df3ac2a672a5284441f120d486acabdd6740fc2a"
},
{
"url": "https://git.kernel.org/stable/c/02925f51377f2a42a6724f00549167499c9302e5"
}
],
"title": "can: ems_usb: validate CPC message lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74460",
"datePublished": "2026-08-15T12:27:01.274Z",
"dateReserved": "2026-08-15T05:44:03.901Z",
"dateUpdated": "2026-08-19T16:36:57.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74461 (GCVE-0-2026-74461)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
i2c: imx: Cancel hrtimer before clearing slave pointer
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: Cancel hrtimer before clearing slave pointer
In i2c_imx_unreg_slave(), the slave pointer is set to NULL after
disabling interrupts. However, a pending interrupt might already
have started the hrtimer (i2c_imx_slave_timeout) before the pointer
was cleared. If the hrtimer fires after i2c_imx->slave is set to
NULL, the timer callback i2c_imx_slave_finish_op() will call
i2c_imx_slave_event() with a NULL slave pointer, which results in a
use-after-free / NULL pointer dereference.
Fix by canceling the hrtimer and waiting for it to complete after
disabling interrupts, before clearing the slave pointer.
Severity
8.4 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < e3da77bdb4015051656bb472c295656bbea03b6f
(git)
Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < 470fe15fb3bb2eba6629be301ca7e991ee3cfb7e (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < a8a1f9ac3d763e721586f15479ef9140b216ddf3 (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < 753060f2b77ff2f386addbd3ecadb95b9f90cddd (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < affd62f5719a78135b7441aa49c8cab3c3b5e838 (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < dab4762ee7f3fd0a01980d5407ba48d0261d3bff (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-imx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3da77bdb4015051656bb472c295656bbea03b6f",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
},
{
"lessThan": "470fe15fb3bb2eba6629be301ca7e991ee3cfb7e",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
},
{
"lessThan": "a8a1f9ac3d763e721586f15479ef9140b216ddf3",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
},
{
"lessThan": "753060f2b77ff2f386addbd3ecadb95b9f90cddd",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
},
{
"lessThan": "affd62f5719a78135b7441aa49c8cab3c3b5e838",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
},
{
"lessThan": "dab4762ee7f3fd0a01980d5407ba48d0261d3bff",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
},
{
"lessThan": "6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f",
"status": "affected",
"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-imx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Cancel hrtimer before clearing slave pointer\n\nIn i2c_imx_unreg_slave(), the slave pointer is set to NULL after\ndisabling interrupts. However, a pending interrupt might already\nhave started the hrtimer (i2c_imx_slave_timeout) before the pointer\nwas cleared. If the hrtimer fires after i2c_imx-\u003eslave is set to\nNULL, the timer callback i2c_imx_slave_finish_op() will call\ni2c_imx_slave_event() with a NULL slave pointer, which results in a\nuse-after-free / NULL pointer dereference.\n\nFix by canceling the hrtimer and waiting for it to complete after\ndisabling interrupts, before clearing the slave pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the imx I2C slave teardown path reached via i2c_slave_unregister during local driver removal on embedded i.MX systems; exploitation requires local proximity to trigger concurrent I2C bus activity on the same controller.\nAC:L - The attacker controls both sides of the race by generating I2C slave traffic to arm/restart the 30us hrtimer while unregister runs, and can retry rapidly across repeated teardown cycles until the window is hit.\nPR:N - No Linux credentials are required when an attacker with physical access to an exposed I2C bus races automated system maintenance (OTA, service restart, driver reload) that calls i2c_slave_unregister on imx slave backends.\nUI:N - Exploitation does not require victim interaction; automated firmware updates or service restarts that unregister the slave driver are sufficient to create the teardown side of the race.\nS:U - Impact is confined to kernel memory corruption and crash on the same host; this is not a VM escape, IOMMU bypass, or cross-security-authority boundary.\nC:H - The timer callback invokes i2c_slave_event with a NULL/freed slave pointer (use-after-free), a memory safety violation that can be leveraged for arbitrary kernel memory read primitives per CVSS UAF guidance.\nI:H - Use-after-free in the slave event callback path can enable heap manipulation and arbitrary kernel write or control-flow hijack, not merely a deterministic NULL dereference crash.\nA:H - Triggering i2c_slave_event with a NULL slave causes kernel oops/panic, and the original patch series notes the last_slave_event loop in i2c_imx_slave_finish_op can hang the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:00.344Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e3da77bdb4015051656bb472c295656bbea03b6f"
},
{
"url": "https://git.kernel.org/stable/c/470fe15fb3bb2eba6629be301ca7e991ee3cfb7e"
},
{
"url": "https://git.kernel.org/stable/c/a8a1f9ac3d763e721586f15479ef9140b216ddf3"
},
{
"url": "https://git.kernel.org/stable/c/753060f2b77ff2f386addbd3ecadb95b9f90cddd"
},
{
"url": "https://git.kernel.org/stable/c/affd62f5719a78135b7441aa49c8cab3c3b5e838"
},
{
"url": "https://git.kernel.org/stable/c/dab4762ee7f3fd0a01980d5407ba48d0261d3bff"
},
{
"url": "https://git.kernel.org/stable/c/6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f"
}
],
"title": "i2c: imx: Cancel hrtimer before clearing slave pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74461",
"datePublished": "2026-08-15T12:27:01.924Z",
"dateReserved": "2026-08-15T05:44:03.901Z",
"dateUpdated": "2026-08-19T16:37:00.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74463 (GCVE-0-2026-74463)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
Fix a severe AB/BA deadlock between the Common Clock Framework (CCF)
and the I2C adapter lock, which triggers when an I2C-controlled clock
generator client (like the Si5351) is registered or modified under the CCF.
During an i2c client clock (generator) frequency change, the CCF acquires its global
'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's
chip registers, stalling for the adapter's I2C bus lock.
Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO
expander handling LEDs) can hold the I2C adapter lock. Inside this parallel
transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host
controller's input clock to calculate bus timings. This call attempts to acquire
the blocked CCF 'prepare_lock', creating a circular dependency that freezes
the system.
The jz4780 host controller clock itself is static and never changes at runtime.
However, calling clk_get_rate() inside the active transfer path introduces
an unnecessary dependency on the CCF internal locks.
Eliminate this synchronous clk_get_rate() call from the active transfer
path by caching the static host peripheral clock rate once - inside the private
jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed()
to use this cached value, safely decoupling active I2C transactions from the
CCF internal locks without any risk of stale timings.
Assisted-by web based Google AI (pinpointing the bug and writing the message).
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ba92222ed63a12d09120df9b92f56cc990abac19 , < cc111696ef420f6bb552b2526530067977f0b406
(git)
Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < f96a719d9f8a797105ec5cacf568ab128e33391f (git) Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < deffad5bb4f8b4f09e46252f24754ddc9960b244 (git) Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < 14429dc1c756c35e106f01ff09cadccb82f5531d (git) Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < b6cb47e186abba85a3b08aa3023067ab82577286 (git) Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < 19b783335d62e7a2367436a6e1f1b37da1878360 (git) Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < aa1944b52d6492c48bdd17046578aa0d953546e6 (git) Affected: ba92222ed63a12d09120df9b92f56cc990abac19 , < d99607c888f26e8a4e9fe9772860cef4aff86bb4 (git) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-jz4780.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc111696ef420f6bb552b2526530067977f0b406",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "f96a719d9f8a797105ec5cacf568ab128e33391f",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "deffad5bb4f8b4f09e46252f24754ddc9960b244",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "14429dc1c756c35e106f01ff09cadccb82f5531d",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "b6cb47e186abba85a3b08aa3023067ab82577286",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "19b783335d62e7a2367436a6e1f1b37da1878360",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "aa1944b52d6492c48bdd17046578aa0d953546e6",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
},
{
"lessThan": "d99607c888f26e8a4e9fe9772860cef4aff86bb4",
"status": "affected",
"version": "ba92222ed63a12d09120df9b92f56cc990abac19",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-jz4780.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock\n\nFix a severe AB/BA deadlock between the Common Clock Framework (CCF)\nand the I2C adapter lock, which triggers when an I2C-controlled clock\ngenerator client (like the Si5351) is registered or modified under the CCF.\n\nDuring an i2c client clock (generator) frequency change, the CCF acquires its global\n\u0027prepare_lock\u0027 mutex and the driver calls i2c_transfer() to update the client\u0027s\nchip registers, stalling for the adapter\u0027s I2C bus lock.\n\nConcurrently, an independent, parallel transfer on the same bus (e.g., a GPIO\nexpander handling LEDs) can hold the I2C adapter lock. Inside this parallel\ntransfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host\ncontroller\u0027s input clock to calculate bus timings. This call attempts to acquire\nthe blocked CCF \u0027prepare_lock\u0027, creating a circular dependency that freezes\nthe system.\n\nThe jz4780 host controller clock itself is static and never changes at runtime.\n\nHowever, calling clk_get_rate() inside the active transfer path introduces\nan unnecessary dependency on the CCF internal locks.\n\nEliminate this synchronous clk_get_rate() call from the active transfer\npath by caching the static host peripheral clock rate once - inside the private\njz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed()\nto use this cached value, safely decoupling active I2C transactions from the\nCCF internal locks without any risk of stale timings.\n\nAssisted-by web based Google AI (pinpointing the bug and writing the message)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:02.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc111696ef420f6bb552b2526530067977f0b406"
},
{
"url": "https://git.kernel.org/stable/c/f96a719d9f8a797105ec5cacf568ab128e33391f"
},
{
"url": "https://git.kernel.org/stable/c/deffad5bb4f8b4f09e46252f24754ddc9960b244"
},
{
"url": "https://git.kernel.org/stable/c/14429dc1c756c35e106f01ff09cadccb82f5531d"
},
{
"url": "https://git.kernel.org/stable/c/b6cb47e186abba85a3b08aa3023067ab82577286"
},
{
"url": "https://git.kernel.org/stable/c/19b783335d62e7a2367436a6e1f1b37da1878360"
},
{
"url": "https://git.kernel.org/stable/c/aa1944b52d6492c48bdd17046578aa0d953546e6"
},
{
"url": "https://git.kernel.org/stable/c/d99607c888f26e8a4e9fe9772860cef4aff86bb4"
}
],
"title": "i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74463",
"datePublished": "2026-08-15T12:27:03.176Z",
"dateReserved": "2026-08-15T05:44:03.901Z",
"dateUpdated": "2026-08-19T16:37:02.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…