Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1090
Vulnerability from certfr_avis - Published: 2026-08-28 - Updated: 2026-08-28
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.105-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-74632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74632"
},
{
"name": "CVE-2026-74452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74452"
},
{
"name": "CVE-2026-74649",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74649"
},
{
"name": "CVE-2026-74441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74441"
},
{
"name": "CVE-2026-68480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68480"
},
{
"name": "CVE-2026-74517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74517"
},
{
"name": "CVE-2026-74450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74450"
},
{
"name": "CVE-2026-74481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74481"
},
{
"name": "CVE-2026-68138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68138"
},
{
"name": "CVE-2026-74597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74597"
},
{
"name": "CVE-2026-74669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74669"
},
{
"name": "CVE-2026-74482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74482"
},
{
"name": "CVE-2026-74598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74598"
},
{
"name": "CVE-2026-74540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74540"
},
{
"name": "CVE-2026-74440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74440"
},
{
"name": "CVE-2026-74502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74502"
},
{
"name": "CVE-2026-53092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53092"
},
{
"name": "CVE-2026-74599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74599"
},
{
"name": "CVE-2026-74569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74569"
},
{
"name": "CVE-2026-74581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
},
{
"name": "CVE-2026-74543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74543"
},
{
"name": "CVE-2026-74696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74696"
},
{
"name": "CVE-2026-74612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74612"
},
{
"name": "CVE-2026-74563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74563"
},
{
"name": "CVE-2026-74457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74457"
},
{
"name": "CVE-2026-74505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74505"
},
{
"name": "CVE-2026-74523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74523"
},
{
"name": "CVE-2026-74453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74453"
},
{
"name": "CVE-2026-74693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74693"
},
{
"name": "CVE-2026-74557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74557"
},
{
"name": "CVE-2026-74607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74607"
},
{
"name": "CVE-2026-74461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74461"
},
{
"name": "CVE-2026-74514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74514"
},
{
"name": "CVE-2026-68132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68132"
},
{
"name": "CVE-2026-74465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74465"
},
{
"name": "CVE-2026-74630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74630"
},
{
"name": "CVE-2026-74682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74682"
},
{
"name": "CVE-2026-74488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74488"
},
{
"name": "CVE-2026-74683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74683"
},
{
"name": "CVE-2025-40054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40054"
},
{
"name": "CVE-2026-74444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74444"
},
{
"name": "CVE-2026-74724",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74724"
},
{
"name": "CVE-2026-74657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74657"
},
{
"name": "CVE-2026-74676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74676"
},
{
"name": "CVE-2026-74460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74460"
},
{
"name": "CVE-2026-74586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74586"
},
{
"name": "CVE-2026-64017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64017"
},
{
"name": "CVE-2026-68276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68276"
},
{
"name": "CVE-2026-74661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74661"
},
{
"name": "CVE-2026-74688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74688"
},
{
"name": "CVE-2026-74572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74572"
},
{
"name": "CVE-2026-74726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74726"
},
{
"name": "CVE-2026-74531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74531"
},
{
"name": "CVE-2026-74549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74549"
},
{
"name": "CVE-2026-68267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68267"
},
{
"name": "CVE-2026-74470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74470"
},
{
"name": "CVE-2026-74478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74478"
},
{
"name": "CVE-2026-74566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74566"
},
{
"name": "CVE-2026-68166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68166"
},
{
"name": "CVE-2026-74473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74473"
},
{
"name": "CVE-2026-74467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74467"
},
{
"name": "CVE-2026-74476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74476"
},
{
"name": "CVE-2026-74691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74691"
},
{
"name": "CVE-2026-74490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74490"
},
{
"name": "CVE-2026-74730",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74730"
},
{
"name": "CVE-2026-68169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68169"
},
{
"name": "CVE-2026-74580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74580"
},
{
"name": "CVE-2026-74565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74565"
},
{
"name": "CVE-2026-74660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74660"
},
{
"name": "CVE-2026-74454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74454"
},
{
"name": "CVE-2026-74493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74493"
},
{
"name": "CVE-2026-74463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74463"
},
{
"name": "CVE-2026-74583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74583"
},
{
"name": "CVE-2026-74725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74725"
},
{
"name": "CVE-2026-74665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74665"
},
{
"name": "CVE-2026-74464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74464"
},
{
"name": "CVE-2026-74636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74636"
},
{
"name": "CVE-2026-74522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74522"
},
{
"name": "CVE-2026-74704",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74704"
},
{
"name": "CVE-2026-74689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74689"
},
{
"name": "CVE-2026-74710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74710"
},
{
"name": "CVE-2026-74622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74622"
},
{
"name": "CVE-2026-74474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74474"
},
{
"name": "CVE-2026-74604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74604"
},
{
"name": "CVE-2026-74451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74451"
},
{
"name": "CVE-2026-74555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74555"
},
{
"name": "CVE-2026-74623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74623"
},
{
"name": "CVE-2026-74456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74456"
},
{
"name": "CVE-2026-74535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74535"
},
{
"name": "CVE-2026-74552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74552"
},
{
"name": "CVE-2026-74714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74714"
},
{
"name": "CVE-2026-74664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74664"
},
{
"name": "CVE-2026-74445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74445"
},
{
"name": "CVE-2026-43197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43197"
},
{
"name": "CVE-2026-74620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74620"
},
{
"name": "CVE-2026-74732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74732"
},
{
"name": "CVE-2026-74499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74499"
},
{
"name": "CVE-2026-74675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74675"
},
{
"name": "CVE-2026-74685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74685"
},
{
"name": "CVE-2026-74701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74701"
},
{
"name": "CVE-2026-74670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74670"
},
{
"name": "CVE-2026-74504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74504"
},
{
"name": "CVE-2026-74637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74637"
},
{
"name": "CVE-2026-74447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74447"
},
{
"name": "CVE-2026-74536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74536"
},
{
"name": "CVE-2026-74589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74589"
},
{
"name": "CVE-2026-74479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74479"
},
{
"name": "CVE-2026-74492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74492"
},
{
"name": "CVE-2026-74641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74641"
},
{
"name": "CVE-2026-68159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68159"
},
{
"name": "CVE-2026-74694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74694"
},
{
"name": "CVE-2026-68367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68367"
},
{
"name": "CVE-2026-74614",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74614"
},
{
"name": "CVE-2026-74442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74442"
},
{
"name": "CVE-2026-68273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68273"
},
{
"name": "CVE-2026-74684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74684"
},
{
"name": "CVE-2026-74608",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74608"
},
{
"name": "CVE-2026-74484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74484"
},
{
"name": "CVE-2026-74459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74459"
},
{
"name": "CVE-2026-74471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74471"
},
{
"name": "CVE-2026-74553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74553"
},
{
"name": "CVE-2026-74671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74671"
},
{
"name": "CVE-2026-74515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74515"
},
{
"name": "CVE-2026-74448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74448"
},
{
"name": "CVE-2026-74592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74592"
},
{
"name": "CVE-2026-64586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64586"
},
{
"name": "CVE-2026-74609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74609"
},
{
"name": "CVE-2026-74487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74487"
},
{
"name": "CVE-2026-74668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74668"
},
{
"name": "CVE-2026-74500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74500"
},
{
"name": "CVE-2026-74618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74618"
},
{
"name": "CVE-2026-74498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74498"
},
{
"name": "CVE-2026-74615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74615"
},
{
"name": "CVE-2026-74524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74524"
},
{
"name": "CVE-2026-74625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74625"
},
{
"name": "CVE-2026-68264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68264"
},
{
"name": "CVE-2026-74446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74446"
},
{
"name": "CVE-2026-74577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74577"
},
{
"name": "CVE-2026-74516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74516"
},
{
"name": "CVE-2026-74590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74590"
},
{
"name": "CVE-2026-74541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74541"
},
{
"name": "CVE-2026-74574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74574"
},
{
"name": "CVE-2026-74567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74567"
},
{
"name": "CVE-2026-74619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74619"
},
{
"name": "CVE-2026-74582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
},
{
"name": "CVE-2026-74519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74519"
},
{
"name": "CVE-2026-74548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74548"
},
{
"name": "CVE-2026-74718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74718"
},
{
"name": "CVE-2026-68118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68118"
},
{
"name": "CVE-2026-74518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74518"
},
{
"name": "CVE-2026-74503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74503"
},
{
"name": "CVE-2026-68322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68322"
},
{
"name": "CVE-2026-74603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74603"
},
{
"name": "CVE-2026-74587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74587"
},
{
"name": "CVE-2026-74663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74663"
},
{
"name": "CVE-2026-74472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74472"
},
{
"name": "CVE-2026-74677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74677"
},
{
"name": "CVE-2026-68082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68082"
},
{
"name": "CVE-2026-74494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74494"
},
{
"name": "CVE-2026-74508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74508"
},
{
"name": "CVE-2026-74672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74672"
},
{
"name": "CVE-2026-74469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74469"
},
{
"name": "CVE-2026-74602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74602"
},
{
"name": "CVE-2026-74483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74483"
},
{
"name": "CVE-2026-74679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74679"
},
{
"name": "CVE-2026-68451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68451"
},
{
"name": "CVE-2026-74717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74717"
},
{
"name": "CVE-2026-74700",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74700"
},
{
"name": "CVE-2026-74610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74610"
},
{
"name": "CVE-2026-74655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74655"
},
{
"name": "CVE-2026-74654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74654"
},
{
"name": "CVE-2026-74658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74658"
},
{
"name": "CVE-2026-74576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74576"
},
{
"name": "CVE-2026-74546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74546"
},
{
"name": "CVE-2026-74680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74680"
},
{
"name": "CVE-2026-74497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74497"
},
{
"name": "CVE-2026-74510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
},
{
"name": "CVE-2026-74455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74455"
},
{
"name": "CVE-2026-74512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74512"
},
{
"name": "CVE-2026-74646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74646"
},
{
"name": "CVE-2026-74588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74588"
},
{
"name": "CVE-2026-68266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68266"
},
{
"name": "CVE-2026-74556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
},
{
"name": "CVE-2026-74532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74532"
},
{
"name": "CVE-2026-74595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74595"
},
{
"name": "CVE-2026-68452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68452"
},
{
"name": "CVE-2026-74692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74692"
},
{
"name": "CVE-2026-74719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74719"
},
{
"name": "CVE-2026-74585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74585"
},
{
"name": "CVE-2026-74651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74651"
},
{
"name": "CVE-2026-74551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74551"
},
{
"name": "CVE-2026-74666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74666"
},
{
"name": "CVE-2026-74705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74705"
},
{
"name": "CVE-2026-68431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68431"
},
{
"name": "CVE-2026-74495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74495"
},
{
"name": "CVE-2026-72111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72111"
},
{
"name": "CVE-2026-68254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68254"
},
{
"name": "CVE-2026-74720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74720"
},
{
"name": "CVE-2026-74547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74547"
},
{
"name": "CVE-2026-74579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74579"
},
{
"name": "CVE-2026-74458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74458"
},
{
"name": "CVE-2026-74647",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74647"
},
{
"name": "CVE-2026-74613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74613"
},
{
"name": "CVE-2026-74525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74525"
},
{
"name": "CVE-2026-74594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74594"
},
{
"name": "CVE-2026-74475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74475"
},
{
"name": "CVE-2026-74659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74659"
},
{
"name": "CVE-2026-68253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68253"
},
{
"name": "CVE-2026-74621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74621"
},
{
"name": "CVE-2025-38525",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38525"
},
{
"name": "CVE-2026-74507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74507"
},
{
"name": "CVE-2026-74606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74606"
},
{
"name": "CVE-2026-74628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74628"
},
{
"name": "CVE-2026-74667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74667"
},
{
"name": "CVE-2026-74601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74601"
},
{
"name": "CVE-2026-74673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74673"
},
{
"name": "CVE-2026-74722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74722"
},
{
"name": "CVE-2026-68198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68198"
},
{
"name": "CVE-2026-74635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74635"
},
{
"name": "CVE-2026-74624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74624"
},
{
"name": "CVE-2026-74678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74678"
},
{
"name": "CVE-2026-74575",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74575"
},
{
"name": "CVE-2026-74480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74480"
},
{
"name": "CVE-2026-74545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74545"
},
{
"name": "CVE-2026-74468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74468"
},
{
"name": "CVE-2026-74631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74631"
},
{
"name": "CVE-2026-74634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74634"
},
{
"name": "CVE-2026-74644",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74644"
},
{
"name": "CVE-2026-74485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74485"
},
{
"name": "CVE-2026-74564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74564"
},
{
"name": "CVE-2026-74616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74616"
},
{
"name": "CVE-2026-74712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74712"
},
{
"name": "CVE-2026-74550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74550"
},
{
"name": "CVE-2026-74509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74509"
},
{
"name": "CVE-2026-74656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74656"
},
{
"name": "CVE-2026-74648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74648"
},
{
"name": "CVE-2026-74650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74650"
},
{
"name": "CVE-2026-74443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74443"
},
{
"name": "CVE-2026-74501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74501"
}
],
"initial_release_date": "2026-08-28T00:00:00",
"last_revision_date": "2026-08-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1090",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-28T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-08-25",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00377",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00377.html"
}
]
}
CVE-2026-74464 (GCVE-0-2026-74464)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
net: openvswitch: fix skb leak on flow key update failure during ct
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix skb leak on flow key update failure during ct
ovs_ct_execute() always steals or frees the skb on failure while
ovs_flow_key_update() does not. So, if it fails and we return right
away, the skb ends up leaked.
Fix that by breaking instead and letting the common error handling
code at the bottom of the loop to free the skb properly.
This is a very unlikely scenario as it requires the packet to become
unparseable by applying a set of actions on a previously parseable skb,
but should be fixed nevertheless.
Reported by Sashiko.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < b77126b2915900f69f9fcf5d624a77c8e6d50c31
(git)
Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < 6cc523eaee72c4e91894136cff64946ae9de2cda (git) Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < 22e0ca88090d89c128078062186b03bb5fdc4f98 (git) Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < 736e972f3f8a304158345223ac6e816166a467ce (git) Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < e84dfaac50aab45ad8c670da43e3aa1f97bd2a41 (git) Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < e0ba8eaef2a0d02a7a485e6a7157e47272b65cea (git) Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < 393f3c72600ab6721d732a0ab245bc896c5b28fc (git) Affected: ec0d043d05e6e3c0c2fac5de922c800c027c6386 , < bc62e843bc48f933da765ce47079fd992e535794 (git) |
|
| Linux | Linux |
Affected:
4.3
Unaffected: 0 , < 4.3 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b77126b2915900f69f9fcf5d624a77c8e6d50c31",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "6cc523eaee72c4e91894136cff64946ae9de2cda",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "22e0ca88090d89c128078062186b03bb5fdc4f98",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "736e972f3f8a304158345223ac6e816166a467ce",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "e84dfaac50aab45ad8c670da43e3aa1f97bd2a41",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "e0ba8eaef2a0d02a7a485e6a7157e47272b65cea",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "393f3c72600ab6721d732a0ab245bc896c5b28fc",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
},
{
"lessThan": "bc62e843bc48f933da765ce47079fd992e535794",
"status": "affected",
"version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix skb leak on flow key update failure during ct\n\novs_ct_execute() always steals or frees the skb on failure while\novs_flow_key_update() does not. So, if it fails and we return right\naway, the skb ends up leaked.\n\nFix that by breaking instead and letting the common error handling\ncode at the bottom of the loop to free the skb properly.\n\nThis is a very unlikely scenario as it requires the packet to become\nunparseable by applying a set of actions on a previously parseable skb,\nbut should be fixed nevertheless.\n\nReported by Sashiko."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:05.367Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b77126b2915900f69f9fcf5d624a77c8e6d50c31"
},
{
"url": "https://git.kernel.org/stable/c/6cc523eaee72c4e91894136cff64946ae9de2cda"
},
{
"url": "https://git.kernel.org/stable/c/22e0ca88090d89c128078062186b03bb5fdc4f98"
},
{
"url": "https://git.kernel.org/stable/c/736e972f3f8a304158345223ac6e816166a467ce"
},
{
"url": "https://git.kernel.org/stable/c/e84dfaac50aab45ad8c670da43e3aa1f97bd2a41"
},
{
"url": "https://git.kernel.org/stable/c/e0ba8eaef2a0d02a7a485e6a7157e47272b65cea"
},
{
"url": "https://git.kernel.org/stable/c/393f3c72600ab6721d732a0ab245bc896c5b28fc"
},
{
"url": "https://git.kernel.org/stable/c/bc62e843bc48f933da765ce47079fd992e535794"
}
],
"title": "net: openvswitch: fix skb leak on flow key update failure during ct",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74464",
"datePublished": "2026-08-15T12:27:03.786Z",
"dateReserved": "2026-08-15T05:44:03.901Z",
"dateUpdated": "2026-08-19T16:37:05.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74465 (GCVE-0-2026-74465)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
net: openvswitch: fix potential UAF on meter attach failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix potential UAF on meter attach failure
While attaching a newly created meter attach_meter() function makes
the new meter visible to other CPUs but can still fail afterwards.
On failure, it detaches the meter back and returns an error.
However, this is an unexpected behavior for the ovs_meter_cmd_set()
that uses a plain kfree(meter) on attach failure without waiting for
RCU readers to stop using it, assuming it was never visible.
This is never a problem for ovs-vswitchd as it always creates meters
before creating any flows that use them. But the UAF can be triggered
with a custom application using uAPI:
BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)
Read of size 8 at addr ffff88810d152650 by task meter/2508
Call Trace:
ovs_meter_execute (net/openvswitch/meter.c:653)
do_execute_actions (net/openvswitch/actions.c:1407)
ovs_execute_actions (net/openvswitch/actions.c:1584)
ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)
...
netlink_sendmsg (af_netlink.c:1900)
Allocated by task 2519:
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
ovs_meter_cmd_set (net/openvswitch/meter.c:422)
...
netlink_sendmsg (af_netlink.c:1900)
Freed by task 2519:
kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
ovs_meter_cmd_set (net/openvswitch/meter.c:479)
...
netlink_sendmsg (af_netlink.c:1900)
Fix that by making sure attach_meter() doesn't make the meter visible
until all the checks are done and the function can't fail anymore.
This also makes sure the "hash" value is calculated after the potential
re-sizing of the table.
Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c7c4c44c9a95d87e50ced38f7480e779cb472174 , < 496f3013c6ff759249abcfb2da2361c1a3e2e66d
(git)
Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac (git) Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < b0de3b58dac3b02b528f72ee0397728aed11f993 (git) Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < 0310d1fa7f9debd0d89629e9f14c7975a47eaa9a (git) Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < 4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3 (git) Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < 90623c9499627803ef3f04fa25a3199402d4fb95 (git) Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < 431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61 (git) Affected: c7c4c44c9a95d87e50ced38f7480e779cb472174 , < a58a2b0ce354df531ebc71fc870058c2feb59f6b (git) |
|
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "496f3013c6ff759249abcfb2da2361c1a3e2e66d",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "b0de3b58dac3b02b528f72ee0397728aed11f993",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "0310d1fa7f9debd0d89629e9f14c7975a47eaa9a",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "90623c9499627803ef3f04fa25a3199402d4fb95",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
},
{
"lessThan": "a58a2b0ce354df531ebc71fc870058c2feb59f6b",
"status": "affected",
"version": "c7c4c44c9a95d87e50ced38f7480e779cb472174",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix potential UAF on meter attach failure\n\nWhile attaching a newly created meter attach_meter() function makes\nthe new meter visible to other CPUs but can still fail afterwards.\nOn failure, it detaches the meter back and returns an error.\n\nHowever, this is an unexpected behavior for the ovs_meter_cmd_set()\nthat uses a plain kfree(meter) on attach failure without waiting for\nRCU readers to stop using it, assuming it was never visible.\n\nThis is never a problem for ovs-vswitchd as it always creates meters\nbefore creating any flows that use them. But the UAF can be triggered\nwith a custom application using uAPI:\n\n BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)\n Read of size 8 at addr ffff88810d152650 by task meter/2508\n\n Call Trace:\n ovs_meter_execute (net/openvswitch/meter.c:653)\n do_execute_actions (net/openvswitch/actions.c:1407)\n ovs_execute_actions (net/openvswitch/actions.c:1584)\n ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)\n ...\n netlink_sendmsg (af_netlink.c:1900)\n\n Allocated by task 2519:\n __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n ovs_meter_cmd_set (net/openvswitch/meter.c:422)\n ...\n netlink_sendmsg (af_netlink.c:1900)\n\n Freed by task 2519:\n kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)\n ovs_meter_cmd_set (net/openvswitch/meter.c:479)\n ...\n netlink_sendmsg (af_netlink.c:1900)\n\nFix that by making sure attach_meter() doesn\u0027t make the meter visible\nuntil all the checks are done and the function can\u0027t fail anymore.\n\nThis also makes sure the \"hash\" value is calculated after the potential\nre-sizing of the table.\n\nReported by Trend Micro\u0027s Zero Day Initiative as ZDI-CAN-31642."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered when ovs_meter_cmd_set() fails attach_meter() and kfree()s the meter without an RCU grace period; that path is only reachable via the ovs_meter genetlink uAPI (netlink_sendmsg), not by remote packet reception alone.\nAC:L - The attacker controls both sides of the race by concurrently issuing OVS_METER_CMD_SET (forcing post-insert attach failure at max_meters or ENOMEM) and OVS_PACKET_CMD_EXECUTE or traffic on flows with OVS_ACTION_ATTR_METER while parallel_ops allows overlapping handlers.\nPR:L - OVS_METER_CMD_SET and OVS_PACKET_CMD_EXECUTE require CAP_NET_ADMIN checked with netlink_ns_capable() against the socket network namespace; unprivileged users can obtain CAP_NET_ADMIN in a user namespace (unshare -Urn) and the genl family is netnsok.\nUI:N - Exploitation requires only programmatic netlink API calls from the attacker; no victim user action such as opening files, mounting filesystems, or clicking prompts is needed.\nS:U - Successful exploitation compromises kernel memory and privileges on the same host/kernel security authority; it does not inherently cross a VM hypervisor, IOMMU, or hardware isolation boundary.\nC:H - This is a slab use-after-free: concurrent ovs_meter_execute() reads freed dp_meter fields (bands, stats, lock) via RCU lookup, enabling heap spraying and arbitrary kernel memory disclosure primitives.\nI:H - The UAF write path updates freed meter and band statistics, bucket counters, and takes a spinlock on freed memory, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - KASAN reproduces slab-use-after-free in ovs_meter_execute during concurrent meter attach failure; UAF on the datapath fast path can cause kernel oops/panic or be abused for repeatable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:07.822Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/496f3013c6ff759249abcfb2da2361c1a3e2e66d"
},
{
"url": "https://git.kernel.org/stable/c/ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac"
},
{
"url": "https://git.kernel.org/stable/c/b0de3b58dac3b02b528f72ee0397728aed11f993"
},
{
"url": "https://git.kernel.org/stable/c/0310d1fa7f9debd0d89629e9f14c7975a47eaa9a"
},
{
"url": "https://git.kernel.org/stable/c/4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3"
},
{
"url": "https://git.kernel.org/stable/c/90623c9499627803ef3f04fa25a3199402d4fb95"
},
{
"url": "https://git.kernel.org/stable/c/431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61"
},
{
"url": "https://git.kernel.org/stable/c/a58a2b0ce354df531ebc71fc870058c2feb59f6b"
}
],
"title": "net: openvswitch: fix potential UAF on meter attach failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74465",
"datePublished": "2026-08-15T12:27:04.403Z",
"dateReserved": "2026-08-15T05:44:03.901Z",
"dateUpdated": "2026-08-19T16:37:07.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74467 (GCVE-0-2026-74467)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
s390/qeth: Check CAP_NET_ADMIN for private ioctls
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: Check CAP_NET_ADMIN for private ioctls
Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
capable check to ensure unprivileged users cannot invoke them.
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
18787eeebd7129ecf4960876d24f349682207783 , < 8fb69547924bbb3d7c900a0d7d137a7234db3f5f
(git)
Affected: 18787eeebd7129ecf4960876d24f349682207783 , < 3ea5210db058347481c93849786982f874f7be2d (git) Affected: 18787eeebd7129ecf4960876d24f349682207783 , < 4e48168825818bf4a13c743582227d15f1d30d04 (git) Affected: 18787eeebd7129ecf4960876d24f349682207783 , < b40c74262f7e1e601221cebccdbdb2b392ff9976 (git) Affected: 18787eeebd7129ecf4960876d24f349682207783 , < bd63c7879eaa87f1958f7ee027813356fcd9ff11 (git) Affected: 18787eeebd7129ecf4960876d24f349682207783 , < 93a0a846ec59a88e0c402878a15357a5ce430eb4 (git) Affected: 18787eeebd7129ecf4960876d24f349682207783 , < d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/qeth_core_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8fb69547924bbb3d7c900a0d7d137a7234db3f5f",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
},
{
"lessThan": "3ea5210db058347481c93849786982f874f7be2d",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
},
{
"lessThan": "4e48168825818bf4a13c743582227d15f1d30d04",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
},
{
"lessThan": "b40c74262f7e1e601221cebccdbdb2b392ff9976",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
},
{
"lessThan": "bd63c7879eaa87f1958f7ee027813356fcd9ff11",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
},
{
"lessThan": "93a0a846ec59a88e0c402878a15357a5ce430eb4",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
},
{
"lessThan": "d211028bac1bd0fff0026bfa2a8328e5b78cd0e6",
"status": "affected",
"version": "18787eeebd7129ecf4960876d24f349682207783",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/qeth_core_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: Check CAP_NET_ADMIN for private ioctls\n\nGate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,\nSIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN\ncapable check to ensure unprivileged users cannot invoke them."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl(2) on a qeth network interface via socket(SIOCDEVPRIVATE+5..+7); the path is sock_ioctl() -\u003e dev_ioctl() -\u003e dev_siocdevprivate() -\u003e qeth_siocdevprivate() with no remote packet or network protocol entry point.\nAC:L - Any local user who can open an AF_INET socket and name a qeth netdev can invoke these ioctls deterministically; no races, special memory layout, or rare kernel configuration is required beyond s390 hardware with qeth present.\nPR:L - The bug is missing CAP_NET_ADMIN in qeth_siocdevprivate(); generic SIOCDEVPRIVATE handling in dev_ioctl() performs no capability check, so any unprivileged local account on an IBM Z/LinuxONE LPAR can reach these handlers without root or namespace-granted admin rights.\nUI:N - Exploitation needs only the attacker opening a socket and issuing ioctl against a qeth interface; no victim login, mount, or other interactive action is required on a shared mainframe guest.\nS:U - Impact stays within kernel/driver control of the local OSA/QDIO adapter and does not cross a VM, container, or IOMMU security boundary; this is standard local privilege and hardware-management misuse, not a guest-to-host escape.\nC:H - SIOC_QETH_QUERY_OAT and SIOC_QETH_ADP_SET_SNMP_CONTROL copy OSA Express firmware response buffers (link attributes, adapter operational data, SNMP MIB objects, card-type details) to unprivileged userspace, disclosing network hardware management information normally restricted to administrators.\nI:H - SIOC_QETH_ADP_SET_SNMP_CONTROL accepts attacker-controlled qeth_snmp_cmd request/data and forwards IPA_SETADP_SET_SNMP_CONTROL commands to OSA firmware, letting unprivileged users alter adapter SNMP/management state on production IBM Z network interfaces.\nA:H - Handlers honor attacker-chosen buffer sizes (kzalloc(udata_len) in qeth_snmp_command and vzalloc(buffer_len) in qeth_query_oat_command without upper bounds), enabling repeated large allocations for kernel memory exhaustion/OOM, and malformed IPA commands can disrupt adapter operation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:10.278Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8fb69547924bbb3d7c900a0d7d137a7234db3f5f"
},
{
"url": "https://git.kernel.org/stable/c/3ea5210db058347481c93849786982f874f7be2d"
},
{
"url": "https://git.kernel.org/stable/c/4e48168825818bf4a13c743582227d15f1d30d04"
},
{
"url": "https://git.kernel.org/stable/c/b40c74262f7e1e601221cebccdbdb2b392ff9976"
},
{
"url": "https://git.kernel.org/stable/c/bd63c7879eaa87f1958f7ee027813356fcd9ff11"
},
{
"url": "https://git.kernel.org/stable/c/93a0a846ec59a88e0c402878a15357a5ce430eb4"
},
{
"url": "https://git.kernel.org/stable/c/d211028bac1bd0fff0026bfa2a8328e5b78cd0e6"
}
],
"title": "s390/qeth: Check CAP_NET_ADMIN for private ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74467",
"datePublished": "2026-08-15T12:27:05.635Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-08-19T16:37:10.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74468 (GCVE-0-2026-74468)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
gpio: pch: use raw_spinlock_t for the register lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: pch: use raw_spinlock_t for the register lock
pch_irq_type() is registered as the irq_chip .irq_set_type callback and
takes chip->spinlock with spin_lock_irqsave(). This callback is reached
from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while
the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.
That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is
an rtmutex-backed sleeping lock, so acquiring it there is invalid.
This was confirmed on a PREEMPT_RT kernel with lockdep
(PROVE_RAW_LOCK_NESTING and DEBUG_ATOMIC_SLEEP). A grounded PoC mirrored
pch_irq_type()'s locking and drove it through the real genirq carrier
irq_set_irq_type() -> __irq_set_trigger() -> chip->irq_set_type(), i.e.
the same __irq_set_trigger() edge that __setup_irq() takes for a
requested IRQ. With the original spin_lock_irqsave() edge lockdep
reported an invalid wait context, immediately followed by:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 95, name: insmod
hardirqs last disabled at (3784): _raw_spin_lock_irqsave+0x4f/0x60
rt_spin_lock+0x3a/0x1c0
repro_irq_set_type+0x64/0xa0 [pch_repro]
__irq_set_trigger+0x69/0x140
irq_set_irq_type+0x78/0xd0
Switching the mirrored lock to raw_spinlock_t made both splats go away.
Convert the register lock to raw_spinlock_t. The same lock also
serializes the GPIO direction/value callbacks and the suspend/resume
register save/restore, but all of those critical sections only perform
MMIO register accesses (ioread32()/iowrite32()) and
irq_set_handler_locked(); none of them contain sleepable operations.
Keeping this register lock non-sleeping is therefore appropriate for the
irqchip callbacks and does not change the GPIO-side locking contract.
This is the same class of issue and fix as recently addressed for other
GPIO controllers, e.g. commit 286533cb14a3 ("gpio: sch: use raw_spinlock_t
in the irq startup path") and commit 90f0109019e6 ("gpio: eic-sprd: use
raw_spinlock_t in the irq startup path").
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < efc76a3f5353dd33a2e2ad48200cd4a18de30a0d
(git)
Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < 935e6872db7faecfbe1a10b3f5d97a62fdff5ec9 (git) Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < 98f292cb6d01487d17988d9fd4e19c13e7adb156 (git) Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < 16da33cb36e663b6967112185e11d00ce8ff957c (git) Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < ff050589a21967883bb55f6dba42568f8367ad4a (git) Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < 466ab0c41d5f54f71cee60619d07c4abd0ffd2cd (git) Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < c0a4ec89fc26e4b679b04f1002c503cb2529acdc (git) Affected: 38eb18a6f92da886fc1af509d25e8f7a49e23d9a , < a02b8950d619123da64f69b70fe1dadef217dfe4 (git) |
|
| Linux | Linux |
Affected:
3.2
Unaffected: 0 , < 3.2 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-pch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "efc76a3f5353dd33a2e2ad48200cd4a18de30a0d",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "935e6872db7faecfbe1a10b3f5d97a62fdff5ec9",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "98f292cb6d01487d17988d9fd4e19c13e7adb156",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "16da33cb36e663b6967112185e11d00ce8ff957c",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "ff050589a21967883bb55f6dba42568f8367ad4a",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "466ab0c41d5f54f71cee60619d07c4abd0ffd2cd",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "c0a4ec89fc26e4b679b04f1002c503cb2529acdc",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
},
{
"lessThan": "a02b8950d619123da64f69b70fe1dadef217dfe4",
"status": "affected",
"version": "38eb18a6f92da886fc1af509d25e8f7a49e23d9a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-pch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pch: use raw_spinlock_t for the register lock\n\npch_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip-\u003espinlock with spin_lock_irqsave(). This callback is reached\nfrom __setup_irq() -\u003e __irq_set_trigger() -\u003e chip-\u003eirq_set_type() while\nthe caller holds desc-\u003elock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\n\nThis was confirmed on a PREEMPT_RT kernel with lockdep\n(PROVE_RAW_LOCK_NESTING and DEBUG_ATOMIC_SLEEP). A grounded PoC mirrored\npch_irq_type()\u0027s locking and drove it through the real genirq carrier\nirq_set_irq_type() -\u003e __irq_set_trigger() -\u003e chip-\u003eirq_set_type(), i.e.\nthe same __irq_set_trigger() edge that __setup_irq() takes for a\nrequested IRQ. With the original spin_lock_irqsave() edge lockdep\nreported an invalid wait context, immediately followed by:\n\n BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 95, name: insmod\n hardirqs last disabled at (3784): _raw_spin_lock_irqsave+0x4f/0x60\n rt_spin_lock+0x3a/0x1c0\n repro_irq_set_type+0x64/0xa0 [pch_repro]\n __irq_set_trigger+0x69/0x140\n irq_set_irq_type+0x78/0xd0\n\nSwitching the mirrored lock to raw_spinlock_t made both splats go away.\n\nConvert the register lock to raw_spinlock_t. The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, but all of those critical sections only perform\nMMIO register accesses (ioread32()/iowrite32()) and\nirq_set_handler_locked(); none of them contain sleepable operations.\nKeeping this register lock non-sleeping is therefore appropriate for the\nirqchip callbacks and does not change the GPIO-side locking contract.\n\nThis is the same class of issue and fix as recently addressed for other\nGPIO controllers, e.g. commit 286533cb14a3 (\"gpio: sch: use raw_spinlock_t\nin the irq startup path\") and commit 90f0109019e6 (\"gpio: eic-sprd: use\nraw_spinlock_t in the irq startup path\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:12.926Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/efc76a3f5353dd33a2e2ad48200cd4a18de30a0d"
},
{
"url": "https://git.kernel.org/stable/c/935e6872db7faecfbe1a10b3f5d97a62fdff5ec9"
},
{
"url": "https://git.kernel.org/stable/c/98f292cb6d01487d17988d9fd4e19c13e7adb156"
},
{
"url": "https://git.kernel.org/stable/c/16da33cb36e663b6967112185e11d00ce8ff957c"
},
{
"url": "https://git.kernel.org/stable/c/ff050589a21967883bb55f6dba42568f8367ad4a"
},
{
"url": "https://git.kernel.org/stable/c/466ab0c41d5f54f71cee60619d07c4abd0ffd2cd"
},
{
"url": "https://git.kernel.org/stable/c/c0a4ec89fc26e4b679b04f1002c503cb2529acdc"
},
{
"url": "https://git.kernel.org/stable/c/a02b8950d619123da64f69b70fe1dadef217dfe4"
}
],
"title": "gpio: pch: use raw_spinlock_t for the register lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74468",
"datePublished": "2026-08-15T12:27:06.250Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-08-19T16:37:12.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74469 (GCVE-0-2026-74469)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
sctp: prevent peer transport count overflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: prevent peer transport count overflow
sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.
SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.
Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8f840e47f190cbe61a96945c13e9551048d42cef , < b453e00da1211e997b82743d28af7714c59c05c8
(git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < dfea32dd76f390e3155177b0038cc47b01386198 (git) Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 80f48523a0fe42db2e7375dff4e38a25c117090a (git) Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 546221b86ceeba0d8fec92d46a0604bb7b62be07 (git) Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 09e722030e8148ba4ed1e42c6b2ea57bda9f9895 (git) Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0 (git) Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75 (git) Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < bd0e9289e2642f6a5c54faad304ce0f41e926d22 (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b453e00da1211e997b82743d28af7714c59c05c8",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "dfea32dd76f390e3155177b0038cc47b01386198",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "80f48523a0fe42db2e7375dff4e38a25c117090a",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "546221b86ceeba0d8fec92d46a0604bb7b62be07",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "09e722030e8148ba4ed1e42c6b2ea57bda9f9895",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
},
{
"lessThan": "bd0e9289e2642f6a5c54faad304ce0f41e926d22",
"status": "affected",
"version": "8f840e47f190cbe61a96945c13e9551048d42cef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association\u0027s 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote SCTP peers add unique transports via INIT address parameters and ASCONF ADD_IP chunks processed in sctp_assoc_add_peer(); this is network ingress on SCTP servers (telecom, signaling gateways) before any local diagnostic action.\nAC:L - An attacker controlling an SCTP association can script 65536 unique peer addresses via connectx, repeated ASCONF ADD_IP, or INIT parameters; no race or victim-specific state is required beyond reaching the transport limit.\nPR:L - The heap overflow is triggered via NETLINK_SOCK_DIAG (ss/netlink), reachable by unprivileged users; SCTP socket creation and connectx need no capabilities beyond a normal local account (including user namespaces).\nUI:N - Exploitation requires no victim interaction; the attacker drives transport accumulation and issues the diagnostic dump themselves.\nS:U - Impact is kernel heap corruption within the same kernel security boundary; this is not a VM escape, sandbox breakout, or cross-authority scope change.\nC:H - When transport_count wraps to zero, inet_diag_msg_sctpaddrs_fill() reserves no space but iterates all 65536 transports, writing ~8 MiB past the skb tail and enabling adjacent kernel heap reads.\nI:H - The same diag path performs a massive out-of-bounds write of sockaddr_storage entries past the allocated skb buffer, corrupting adjacent kernel heap objects and enabling control-flow hijacking.\nA:H - Corrupting sk_buff heap metadata and adjacent allocations via an ~8 MiB out-of-bounds write can cause kernel oops, panic, or hang, meeting high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:15.198Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8"
},
{
"url": "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198"
},
{
"url": "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a"
},
{
"url": "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07"
},
{
"url": "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895"
},
{
"url": "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"
},
{
"url": "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"
},
{
"url": "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22"
}
],
"title": "sctp: prevent peer transport count overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74469",
"datePublished": "2026-08-15T12:27:06.873Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-08-19T16:37:15.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74470 (GCVE-0-2026-74470)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-23 12:47
VLAI
EPSS
VEX
Title
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
resp_report_zones() sizes the reply buffer from the CDB allocation
length. The v3 fix rounds alloc_len up with ALIGN() before deriving the
descriptor count:
rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -
RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);
arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);
For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to
0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit
and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which
passes the !arr check, and desc = arr + 64 is then dereferenced in the
loop -> out-of-bounds write / panic.
Clamp rep_max_zones to devip->nr_zones. The loop already stops at
sdebug_capacity (after nr_zones zones), so a report can never hold more
than nr_zones descriptors; the clamp does not change the report, it only
bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device
property that can never reach 0x100000000.
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ebacb44cb2042b90951140eda806bedad23ef554 , < 7b615fc139e35c81077046df44725c532f7e2404
(git)
Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 5d3e1d006bbb543259f9e31824caadbfff6a5465 (git) Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 49e5b25a0b74dbac595f122e5608fdce2918cc4e (git) Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 495058429ca55ab7fcc21977b63b92907ad68066 (git) Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 2047ed09bf13453b7d6f9431b112ec07984dd69b (git) Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < d6e6da6bc3b53231fac77ffab428da8173ee729c (git) Affected: 7db0e0c8190a086ef92ce5bb960836cde49540aa , < 93dde0bf2f39a0f9f57fd610aa3201ce5b753433 (git) Affected: c4d2d7c935a4ad20e8e726ca10499cefe4537103 (git) Affected: 5.15.8 , < 5.15.217 (semver) Affected: 5.10.85 , < 5.11 (semver) |
|
| Linux | Linux |
Affected:
5.16
Unaffected: 0 , < 5.16 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_debug.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b615fc139e35c81077046df44725c532f7e2404",
"status": "affected",
"version": "ebacb44cb2042b90951140eda806bedad23ef554",
"versionType": "git"
},
{
"lessThan": "5d3e1d006bbb543259f9e31824caadbfff6a5465",
"status": "affected",
"version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
"versionType": "git"
},
{
"lessThan": "49e5b25a0b74dbac595f122e5608fdce2918cc4e",
"status": "affected",
"version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
"versionType": "git"
},
{
"lessThan": "495058429ca55ab7fcc21977b63b92907ad68066",
"status": "affected",
"version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
"versionType": "git"
},
{
"lessThan": "2047ed09bf13453b7d6f9431b112ec07984dd69b",
"status": "affected",
"version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
"versionType": "git"
},
{
"lessThan": "d6e6da6bc3b53231fac77ffab428da8173ee729c",
"status": "affected",
"version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
"versionType": "git"
},
{
"lessThan": "93dde0bf2f39a0f9f57fd610aa3201ce5b753433",
"status": "affected",
"version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
"versionType": "git"
},
{
"status": "affected",
"version": "c4d2d7c935a4ad20e8e726ca10499cefe4537103",
"versionType": "git"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "5.15.8",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.85",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_debug.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) \u003e\u003e ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()\u0027s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -\u003e out-of-bounds write / panic.\n\nClamp rep_max_zones to devip-\u003enr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached by sending a crafted ZONE IN REPORT ZONES SCSI CDB through local SG_IO/BSG ioctl on a scsi_debug zoned LUN; scsi_debug is a pseudo host simulator with no native network protocol handler.\nAC:L - Once scsi_debug is loaded in host-managed zoned mode, a single REPORT ZONES command with ALLOCATION LENGTH 1-63 reliably underflows rep_max_zones and forces heap writes past a tiny kzalloc buffer; no races or victim-dependent timing are required.\nPR:L - ZBC_IN is whitelisted in scsi_cmd_allowed() without CAP_SYS_RAWIO, so any local user who can open the scsi_debug /dev/sg or BSG node (e.g., disk group) can issue the malicious CDB; module load and zoned setup are environmental, not exploit-time privileges.\nUI:N - Exploitation requires only the attacker issuing SG_IO/BSG with a malicious REPORT ZONES CDB; no separate victim interaction such as mounting media or clicking a prompt is needed.\nS:U - The out-of-bounds write corrupts kernel heap memory in the same host kernel security authority; it is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - The kmalloc heap out-of-bounds write can corrupt adjacent slab objects and be groomed into arbitrary kernel memory disclosure primitives; per kernel guidance, exploitable out-of-bounds writes warrant High confidentiality impact.\nI:H - Attacker-controlled REPORT ZONES allocation length drives rep_max_zones and causes repeated 64-byte descriptor writes far beyond the allocated buffer, providing a kernel heap out-of-bounds write suitable for control-data corruption and privilege escalation.\nA:H - Writing zone descriptors from arr+64 when the buffer is smaller than 64 bytes immediately corrupts out-of-bounds kernel memory and commonly triggers KASAN faults, kernel oops, or panic, satisfying High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:20.125Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404"
},
{
"url": "https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465"
},
{
"url": "https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e"
},
{
"url": "https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066"
},
{
"url": "https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b"
},
{
"url": "https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c"
},
{
"url": "https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433"
}
],
"title": "scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74470",
"datePublished": "2026-08-15T12:27:07.504Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-08-23T12:47:20.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74471 (GCVE-0-2026-74471)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
tracing: Check return value of __register_event() in trace_module_add_events()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Check return value of __register_event() in trace_module_add_events()
trace_module_add_events() ignores the return value of __register_event()
and unconditionally calls __add_event_to_tracers() for each event.
If __register_event() fails (for example, if event_init() fails), the
trace_event_call is not added to ftrace_events list, but
__add_event_to_tracers() still creates a trace_event_file pointing to it.
If module loading subsequently fails and module memory is freed, tracing
state retains a stale trace_event_call pointer in trace_event_file,
leading to a use-after-free when tracefs or tracing subsystem operations
are later executed.
Fix this by checking the return value of __register_event() and only
calling __add_event_to_tracers() if event registration succeeded.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ae63b31e4d0e2ec09c569306ea46f664508ef717 , < 3bf965a2827c44f03294107703e7ba53fbd0a69a
(git)
Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < 9d6d79744f01eacaf3d5522f4fcd59939581abfd (git) Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < 54b7a358f6399c1242d2fb7f4f96085af34baa5e (git) Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5 (git) Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < 22f954f7a8afe975e85517aff41b35defe05144b (git) Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca (git) Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < 000765dcdc3edf128990762790543adc4b868f6c (git) Affected: ae63b31e4d0e2ec09c569306ea46f664508ef717 , < ac8719969e6c3c54e939834df812bc41f25453cf (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bf965a2827c44f03294107703e7ba53fbd0a69a",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "9d6d79744f01eacaf3d5522f4fcd59939581abfd",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "54b7a358f6399c1242d2fb7f4f96085af34baa5e",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "22f954f7a8afe975e85517aff41b35defe05144b",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "000765dcdc3edf128990762790543adc4b868f6c",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
},
{
"lessThan": "ac8719969e6c3c54e939834df812bc41f25453cf",
"status": "affected",
"version": "ae63b31e4d0e2ec09c569306ea46f664508ef717",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check return value of __register_event() in trace_module_add_events()\n\ntrace_module_add_events() ignores the return value of __register_event()\nand unconditionally calls __add_event_to_tracers() for each event.\n\nIf __register_event() fails (for example, if event_init() fails), the\ntrace_event_call is not added to ftrace_events list, but\n__add_event_to_tracers() still creates a trace_event_file pointing to it.\nIf module loading subsequently fails and module memory is freed, tracing\nstate retains a stale trace_event_call pointer in trace_event_file,\nleading to a use-after-free when tracefs or tracing subsystem operations\nare later executed.\n\nFix this by checking the return value of __register_event() and only\ncalling __add_event_to_tracers() if event registration succeeded."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local init_module/finit_module module loading (MODULE_STATE_COMING notifier) and subsequent tracefs/tracing operations on poisoned event files; there is no network, adjacent-wireless, or physical-device input path into trace_module_add_events() or the stale trace_event_file dereferences.\nAC:L - An attacker can deterministically craft a module whose trace events fail event_init()/__register_event() while __add_event_to_tracers() still runs, then force module-load failure or rmmod to free module memory; no uncontrollable race, rare kernel config, or victim-specific memory layout is required.\nPR:L - Triggering the UAF requires only local tracefs/tracing access, which tracing_check_open() gates solely with LOCKDOWN_TRACEFS and DAC (no capable() check), commonly granted to tracing-group/Android/ChromeOS diagnostics users; priming stale pointers via init_module uses capable(CAP_SYS_MODULE) but is achievable on permissive dev/container hosts loading attacker modules.\nUI:N - Once tracefs is accessible, the attacker can read/write event enable/format files or invoke tracing helpers that iterate tr-\u003eevents and dereference the stale trace_event_call without any separate victim user performing mounts, clicks, or configuration changes.\nS:U - The use-after-free corrupts kernel tracing heap/metadata within the same OS security authority and enables local privilege escalation; it does not cross VM, container, IOMMU, or hardware trust boundaries.\nC:H - Stale trace_event_file-\u003eevent_call pointers reference freed module slab memory; subsequent trace_event_name(), call-\u003eclass, and reg/unreg callbacks read attacker-influenced reclaimed heap contents, giving an arbitrary kernel memory read primitive typical of UAF bugs.\nI:H - Operations such as __ftrace_event_enable_disable() invoke call-\u003eclass-\u003ereg() through the dangling trace_event_call and manipulate event flags/filters on reclaimed objects, providing controllable kernel writes and a standard UAF path to code execution.\nA:H - Dereferencing freed module-resident trace_event_call structures from tracefs or tracing subsystem operations readily causes kernel oops/panic; even without full exploitation, the UAF reliably threatens system availability and can be retriggered at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:20.725Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a"
},
{
"url": "https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd"
},
{
"url": "https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e"
},
{
"url": "https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5"
},
{
"url": "https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b"
},
{
"url": "https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca"
},
{
"url": "https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c"
},
{
"url": "https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf"
}
],
"title": "tracing: Check return value of __register_event() in trace_module_add_events()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74471",
"datePublished": "2026-08-15T12:27:08.128Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-08-19T16:37:20.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74472 (GCVE-0-2026-74472)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into
ub->dev_info and then fixes up the fields the driver owns, but misses
->state and ->ublksrv_pid.
A device added with ->state = UBLK_S_DEV_LIVE passes the
"->state != UBLK_S_DEV_DEAD" test that ublk_stop_dev_unlocked() uses as its
proxy for "a disk is attached", while ->ub_disk is still NULL, so DEL_DEV
right after ADD_DEV oopses in del_gendisk(). UBLK_S_DEV_QUIESCED plus
UBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev(). A
poisoned ->state also gets START_USER_RECOVERY and the char device
read/write path onto a device that was never started, and wedges START_DEV
at -EEXIST. A poisoned ->ublksrv_pid just makes GET_DEV_INFO report an
unrelated task as the ublk server.
Reset both after the memcpy(), as ublk_detach_disk() does. Userspace only
ever reads these back, so correcting them silently breaks nothing.
ADD_DEV has copied ->state in unsanitized since ublk was merged, but back
then it was harmless: the gendisk was allocated during ADD_DEV, and both
teardown and the START_DEV -EEXIST check keyed off disk_live() rather than
->state. The oops became reachable once the disk allocation moved to
START_DEV and those checks switched to ->state.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6d9e6dfdf3b207701471f364121c67eefb000682 , < 787c944502e7e63d20a9201bada77e0dd924f458
(git)
Affected: 6d9e6dfdf3b207701471f364121c67eefb000682 , < ee41b00858ca65b4428e99efe39a4277c1f043d2 (git) Affected: 6d9e6dfdf3b207701471f364121c67eefb000682 , < b67ce16b26ad0f14cfd6071013840aa95f823bea (git) Affected: 6d9e6dfdf3b207701471f364121c67eefb000682 , < 205feb72e5beb3140e4e1403b6cff30cf739bab9 (git) Affected: 6d9e6dfdf3b207701471f364121c67eefb000682 , < 127033b79383a3e78361d7e971588aa8849f5124 (git) Affected: 6d9e6dfdf3b207701471f364121c67eefb000682 , < e65848e4ce352bac9e3465099354c8b8f845391f (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/ublk_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "787c944502e7e63d20a9201bada77e0dd924f458",
"status": "affected",
"version": "6d9e6dfdf3b207701471f364121c67eefb000682",
"versionType": "git"
},
{
"lessThan": "ee41b00858ca65b4428e99efe39a4277c1f043d2",
"status": "affected",
"version": "6d9e6dfdf3b207701471f364121c67eefb000682",
"versionType": "git"
},
{
"lessThan": "b67ce16b26ad0f14cfd6071013840aa95f823bea",
"status": "affected",
"version": "6d9e6dfdf3b207701471f364121c67eefb000682",
"versionType": "git"
},
{
"lessThan": "205feb72e5beb3140e4e1403b6cff30cf739bab9",
"status": "affected",
"version": "6d9e6dfdf3b207701471f364121c67eefb000682",
"versionType": "git"
},
{
"lessThan": "127033b79383a3e78361d7e971588aa8849f5124",
"status": "affected",
"version": "6d9e6dfdf3b207701471f364121c67eefb000682",
"versionType": "git"
},
{
"lessThan": "e65848e4ce352bac9e3465099354c8b8f845391f",
"status": "affected",
"version": "6d9e6dfdf3b207701471f364121c67eefb000682",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/ublk_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()\n\nublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into\nub-\u003edev_info and then fixes up the fields the driver owns, but misses\n-\u003estate and -\u003eublksrv_pid.\n\nA device added with -\u003estate = UBLK_S_DEV_LIVE passes the\n\"-\u003estate != UBLK_S_DEV_DEAD\" test that ublk_stop_dev_unlocked() uses as its\nproxy for \"a disk is attached\", while -\u003eub_disk is still NULL, so DEL_DEV\nright after ADD_DEV oopses in del_gendisk(). UBLK_S_DEV_QUIESCED plus\nUBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev(). A\npoisoned -\u003estate also gets START_USER_RECOVERY and the char device\nread/write path onto a device that was never started, and wedges START_DEV\nat -EEXIST. A poisoned -\u003eublksrv_pid just makes GET_DEV_INFO report an\nunrelated task as the ublk server.\n\nReset both after the memcpy(), as ublk_detach_disk() does. Userspace only\never reads these back, so correcting them silently breaks nothing.\n\nADD_DEV has copied -\u003estate in unsanitized since ublk was merged, but back\nthen it was harmless: the gendisk was allocated during ADD_DEV, and both\nteardown and the START_DEV -EEXIST check keyed off disk_live() rather than\n-\u003estate. The oops became reachable once the disk allocation moved to\nSTART_DEV and those checks switched to -\u003estate."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:23.182Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/787c944502e7e63d20a9201bada77e0dd924f458"
},
{
"url": "https://git.kernel.org/stable/c/ee41b00858ca65b4428e99efe39a4277c1f043d2"
},
{
"url": "https://git.kernel.org/stable/c/b67ce16b26ad0f14cfd6071013840aa95f823bea"
},
{
"url": "https://git.kernel.org/stable/c/205feb72e5beb3140e4e1403b6cff30cf739bab9"
},
{
"url": "https://git.kernel.org/stable/c/127033b79383a3e78361d7e971588aa8849f5124"
},
{
"url": "https://git.kernel.org/stable/c/e65848e4ce352bac9e3465099354c8b8f845391f"
}
],
"title": "ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74472",
"datePublished": "2026-08-15T12:27:08.759Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-08-19T16:37:23.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74473 (GCVE-0-2026-74473)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
EPSS
VEX
Title
vxlan: use pskb_network_may_pull() in route_shortcircuit()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() in route_shortcircuit()
route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))
(or ipv6hdr), which checks if bytes are available starting from skb->data.
However, in vxlan_xmit(), skb->data points to the MAC header, so
skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)
only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of
IP header), leaving the rest of the IP header potentially un-pulled in non-linear
frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled
linear buffer length.
Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to
the length check to ensure the full network header is present in the linear buffer.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e4f67addf158f98f8197e08974966b18480dc751 , < c419af4924c1593500a40519730ed98575d04a3e
(git)
Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 6bd0a3a1b5744166946f0c551a6665c3b46b05e4 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 214ba43faf106cb06cd3dd30999c5c809c868b53 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 42887be7c4cf283cce02cd0fb6411221167c8b6c (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < aa0d31376d574ac858a40078431a77127bf04ee4 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < ee799977d7941dbfb11049e17edd9eaf4f8820f7 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 4f3f96e771a20263635bb5e1307c112d613b4bbd (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c419af4924c1593500a40519730ed98575d04a3e",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "6bd0a3a1b5744166946f0c551a6665c3b46b05e4",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "214ba43faf106cb06cd3dd30999c5c809c868b53",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "42887be7c4cf283cce02cd0fb6411221167c8b6c",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "aa0d31376d574ac858a40078431a77127bf04ee4",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "ee799977d7941dbfb11049e17edd9eaf4f8820f7",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "4f3f96e771a20263635bb5e1307c112d613b4bbd",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb-\u003edata.\n\nHowever, in vxlan_xmit(), skb-\u003edata points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb-\u003edata (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)-\u003edaddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - route_shortcircuit() runs in vxlan_xmit() during overlay transmit; remote packets forwarded or routed onto a VXLAN netdev with route-short-circuit enabled reach this path without local access, matching net-stack guidance for network-reachable packet processing on cloud/SDN nodes.\nAC:L - An attacker can reliably craft non-linear skbs (scatter/gather/frags and size boundaries) and aim traffic at a known router MAC in the VXLAN FDB; no race or uncontrollable memory layout is required beyond targeting an RSC-enabled deployment, which is the scored scenario.\nPR:N - Exploitation needs no credentials or capabilities on the victim when VXLAN RSC is already configured; a remote peer only has to send IPv4/IPv6 frames that traverse the tunnel transmit path, with no netlink setup or CAP_NET_ADMIN in the target namespace.\nUI:N - Triggering the bug requires only attacker-controlled network traffic through the overlay; no victim mount, file open, link click, or other interactive action is needed.\nS:U - Impact is confined to the kernel hosting the VXLAN endpoint (memory disclosure, packet-header corruption, or crash); it does not cross VM, container, or IOMMU security boundaries by itself.\nC:H - The faulty pskb_may_pull() check leaves the IP/IPv6 header in non-linear frags, so ip_hdr(skb)-\u003edaddr/ipv6 daddr is read past the linear head and can disclose adjacent kernel memory per OOB-read guidance.\nI:H - The out-of-bounds destination address feeds neigh_lookup() and may rewrite eth_hdr()-\u003eh_dest before encapsulation, giving attacker-influenced overlay forwarding and a memory-safety primitive in the transmit path.\nA:H - Dereferencing network-header fields beyond the pulled linear buffer can provoke kernel oops/panic on affected skb layouts, and OOB reads in xmit context are treated as high availability impact even when exploitation is not fully weaponized."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:25.639Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e"
},
{
"url": "https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4"
},
{
"url": "https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53"
},
{
"url": "https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c"
},
{
"url": "https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4"
},
{
"url": "https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7"
},
{
"url": "https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd"
},
{
"url": "https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb"
}
],
"title": "vxlan: use pskb_network_may_pull() in route_shortcircuit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74473",
"datePublished": "2026-08-15T12:27:09.382Z",
"dateReserved": "2026-08-15T05:44:03.903Z",
"dateUpdated": "2026-08-19T16:37:25.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74474 (GCVE-0-2026-74474)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-23 12:47
VLAI
EPSS
VEX
Title
vxlan: use pskb_network_may_pull() for transmit path header pulls
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() for transmit path header pulls
In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was
being called to verify the availability of network layer headers (ARP, IPv6/ND,
IP/IPv6 MDB keys).
However, during transmit skb->data points to the MAC header, so skb_network_offset(skb)
is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data
rather than skb_network_offset(skb) + len, which can leave part of the network header
in non-linear frags.
Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly
account for the MAC header offset.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e4f67addf158f98f8197e08974966b18480dc751 , < bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4
(git)
Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 6146901881f09ef063eb34ad389f63231f8486f5 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 94dee751aad627b3645d424b5d0c736d394573e9 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 7076a34b6e33315dc160b4612bfea1c597495585 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < b9553558b48db54ac9273e6b98d7263ef5c1a329 (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c",
"drivers/net/vxlan/vxlan_mdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "6146901881f09ef063eb34ad389f63231f8486f5",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "94dee751aad627b3645d424b5d0c736d394573e9",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "7076a34b6e33315dc160b4612bfea1c597495585",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "b9553558b48db54ac9273e6b98d7263ef5c1a329",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c",
"drivers/net/vxlan/vxlan_mdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() for transmit path header pulls\n\nIn vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was\nbeing called to verify the availability of network layer headers (ARP, IPv6/ND,\nIP/IPv6 MDB keys).\n\nHowever, during transmit skb-\u003edata points to the MAC header, so skb_network_offset(skb)\nis ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb-\u003edata\nrather than skb_network_offset(skb) + len, which can leave part of the network header\nin non-linear frags.\n\nReplace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly\naccount for the MAC header offset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in VXLAN transmit handling reached when overlay/bridged traffic is sent through a VXLAN netdev; remote peers on cloud/Kubernetes/OpenStack overlay networks can inject ARP, ND, or multicast frames that traverse vxlan_xmit without local shell access.\nAC:L - Once a VXLAN device has proxy or MDB enabled, an attacker can reliably craft non-linear sk_buff frames (fragmented payloads with headers split across head/frags) to pass the undersized pskb_may_pull check and trigger out-of-bounds header reads.\nPR:N - Exploitation requires only the ability to send L2/L3 traffic on an existing VXLAN overlay; no host credentials, root, or CAP_NET_ADMIN on the victim are needed because any unauthenticated remote tenant VM, pod, or overlay peer can forward triggering frames into the transmit path.\nUI:N - No victim user action is required; the kernel processes attacker-supplied network frames automatically during normal overlay bridging and VXLAN encapsulation.\nS:U - Impact is confined to the kernel network stack on the affected host; it does not cross a VM, container, or hypervisor security boundary into a different authority.\nC:H - Undersized pskb_may_pull allows direct network-header pointer access past skb_headlen into non-linear frags or adjacent kernel memory, constituting an out-of-bounds kernel read capable of disclosing sensitive heap or packet-buffer contents.\nI:H - Out-of-bounds parsed ARP, ND, and IP header fields drive proxy neighbour replies and MDB multicast forwarding decisions, letting an attacker influence overlay neighbour resolution and traffic redirection on the victim node.\nA:H - Out-of-bounds header access in the atomic VXLAN transmit path can cause kernel oops or panic, and an unauthenticated remote attacker can trigger this repeatedly for denial of service against VXLAN-enabled infrastructure nodes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:21.225Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4"
},
{
"url": "https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5"
},
{
"url": "https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9"
},
{
"url": "https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585"
},
{
"url": "https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329"
}
],
"title": "vxlan: use pskb_network_may_pull() for transmit path header pulls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74474",
"datePublished": "2026-08-15T12:27:10.037Z",
"dateReserved": "2026-08-15T05:44:03.903Z",
"dateUpdated": "2026-08-23T12:47:21.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…