{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:26.756Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jfs/jfs_dtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81af4b34fd72d390d7f237c6a545cc6d09707956",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bfa4655d28f338e68d345aed80d19be7999bbce2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "44618bee303bed151ef3a525ff79fbd7689593b5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c8733634978086b41255695d993cec3017a23a27",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2ec34dc7094b14149ce091c77aff43a45d255518",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c8399564a58fb6ea2ff21a6fd278417943cb51a5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5dff41a86377563f7a2b968aae00d25b4ceb37c9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jfs/jfs_dtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack requires a crafted JFS image to be presented to and mounted on the local system (loop device, or removable media auto-mounted by udisks2/autofs on a kiosk or shared workstation), after which the trigger is an ordinary local getdents64() syscall on a directory. There is no network or remote-peer input path into jfs_readdir()/add_missing_indices().\nAC:L - Every controlling value \u2014 the negative stbl[] entries, the starting slot in the dir_table entry that makes readdir skip them, the out-of-range d-\u003eindex that sets fix_page, and next_index \u2014 is read verbatim from the attacker\u0027s image, so the out-of-bounds access is fully deterministic with no race, timing, or memory-layout condition outside the attacker\u0027s control.\nPR:N - The attacker only has to author the filesystem image and needs no account or privilege on the target; once mounted, the vulnerable path is reached by an unprivileged readdir with no capable() or permission check anywhere between the syscall and add_missing_indices().\nUI:R - A user or an automounter on the victim system must mount the malicious JFS image read-write before the corrupted dtree page is ever ingested; on a desktop the file manager then issues the getdents that trips the bug without further action.\nS:U - The out-of-bounds read, the out-of-bounds write, and the corrupted journal records are all confined to the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The negative index reads kernel memory up to 4064 bytes before the metapage folio, and because lv-\u003eoffset is u8 the same value makes lmWriteRecord() memcpy 32 bytes from up to 4064 bytes past the metapage into the journal, persisting kernel heap contents onto storage the attacker supplied and can read back \u2014 far beyond a bounded few-byte read.\nI:H - When the out-of-bounds-read d-\u003eindex fails the (2 \u003c= index \u003c next_index) test \u2014 which arbitrary adjacent heap data almost always does \u2014 the code performs a 4-byte out-of-bounds write of add_index()\u0027s return value at an attacker-chosen 32-byte-aligned offset among 128 possible slots before the metapage, giving a groomable heap corruption primitive in addition to the bogus linelock that corrupts the on-disk journal.\nA:H - The wild read and write reach adjacent page-cache folios and other kernel allocations, producing a KASAN report/oops or corrupting live kernel structures, and the malformed journal line-vector writes garbage into the log; the attacker can repeat the readdir arbitrarily, so a kernel panic is readily achievable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:36:51.285Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8733634978086b41255695d993cec3017a23a27"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ec34dc7094b14149ce091c77aff43a45d255518"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9"
        }
      ],
      "title": "jfs: fix array-index-out-of-bounds read in add_missing_indices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38204",
    "datePublished": "2025-07-04T13:37:24.606Z",
    "dateReserved": "2025-04-16T04:51:23.994Z",
    "dateUpdated": "2026-10-21T12:36:51.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40158",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:00:29.008533Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:00:37.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "423895685f367b5a0a956bd14b02df0192bded4c",
              "status": "affected",
              "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
              "versionType": "git"
            },
            {
              "lessThan": "92803b826e40e49a5e8a6e208f4b4574e9d19426",
              "status": "affected",
              "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
              "versionType": "git"
            },
            {
              "lessThan": "0393f85c3241c19ba8550f04a812e7d19f6b3082",
              "status": "affected",
              "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
              "versionType": "git"
            },
            {
              "lessThan": "11709573cc4e48dc34c80fc7ab9ce5b159e29695",
              "status": "affected",
              "version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU in ip6_output()\n\nUse RCU in ip6_output() in order to use dst_dev_rcu() to prevent\npossible UAF.\n\nWe can remove rcu_read_lock()/rcu_read_unlock() pairs\nfrom ip6_finish_output2()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - `ip6_output()` is the IPv6 egress path for *forwarded* packets \u2014 `ip6_forward()` \u2192 `ip6_forward_finish()` \u2192 `dst_output()` \u2192 `ip6_output()` \u2014 so a remote, unauthenticated attacker\u0027s IPv6 traffic drives the vulnerable function on any Linux router, gateway, or container/cloud host, matching sibling CVE-2025-40168 in the same dst_dev_rcu series.\nAC:H - The remote attacker supplies the traffic side of the race freely, but the `dst_dev_put()` side (netdev unregister/link down, veth deletion, route-exception teardown) is an operational event they cannot influence from the network, and the freed `inet6_dev`/`net_device` must be reallocated with useful content to escalate beyond a crash.\nPR:N - Packets on the forwarding path reach `ip6_output()` with no credentials, no socket, and no local account on the target \u2014 the router transmits them automatically. (Even in the purely local framing the netns/CAP_NET_ADMIN half is obtainable via `unshare -Urn`, so no real privilege is required either way.)\nUI:N - Transmission and forwarding happen unconditionally in softirq/process context on packet arrival; no administrator or local user has to open, mount, or click anything.\nS:U - The freed `inet6_dev` and `net_device` are kernel objects and the corruption stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of `idev-\u003ecnf.disable_ipv6`, `idev-\u003estats.ipv6`, `dev-\u003ehard_header_len`/`needed_headroom`, `dev-\u003eheader_ops` and `dev-\u003eflags`; once the freed slab object is reallocated the attacker can steer header-expansion sizes and the egress device, yielding kernel memory disclosure and out-of-device packet leakage.\nI:H - `IP6_INC_STATS`/`IP6_UPD_PO_STATS` expand to `SNMP_INC_STATS64(idev-\u003estats.ipv6, field)`, performing a 64-bit increment through a per-CPU pointer loaded from freed memory \u2014 an arbitrary-write primitive after reallocation \u2014 and `neigh_output()` \u2192 `dev_queue_xmit()` makes an indirect call through `dev-\u003enetdev_ops-\u003endo_start_xmit` read from the freed `net_device`, giving control-flow hijack.\nA:H - Dereferencing a freed `inet6_dev`/`net_device` on the packet transmit path reliably oopses or panics the kernel (KASAN slab-use-after-free), and the crash is in the core IPv6 output path so it takes down the whole forwarding host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:37:50.501Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/423895685f367b5a0a956bd14b02df0192bded4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/92803b826e40e49a5e8a6e208f4b4574e9d19426"
        },
        {
          "url": "https://git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082"
        },
        {
          "url": "https://git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695"
        }
      ],
      "title": "ipv6: use RCU in ip6_output()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40158",
    "datePublished": "2025-11-12T10:23:29.516Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-10-21T12:37:50.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:24:11.399025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:47:12.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed8d3bd8272e49ea987100de2abfb13710329a9b",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "8fdd2204503ab1ce07dc000c277e2c3edf96a67b",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "5593c640f9daedec8de61555c41e1019fa675aa6",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "00e370627f2e1fb3585f9d26348b1abddc75442b",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "28ecfb3d1fe8dea70319de7051cb6718c25b5b52",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "a557816c6e38e9473d99aa9ea8c662f55fc85847",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "1346be9379639c30877083b12747d4eacb83c24f",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            },
            {
              "lessThan": "a6134e62dba2ea4f760b29d5226907f447c92400",
              "status": "affected",
              "version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: join hook list via splice_list_rcu() in commit phase\n\nPublish new hooks in the list into the basechain/flowtable using\nsplice_list_rcu() to ensure netlink dump list traversal via rcu is safe\nwhile concurrent ruleset update is going on."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachability is through nfnetlink/nftables netlink operations (`NFT_MSG_NEWCHAIN`/`NEWFLOWTABLE` and concurrent `GETCHAIN`/`GETFLOWTABLE` dumps), which require local ability to send netlink messages.\nAC:L - The bug is a race between an attacker-controlled ruleset update and an attacker-controlled concurrent RCU dump; both sides can be generated repeatedly from local processes.\nPR:L - nfnetlink checks `CAP_NET_ADMIN` in the target network namespace, and nftables/netfilter administration is reachable from unprivileged users via user+network namespaces on affected configurations.\nUI:N - No victim interaction is required; the attacker triggers both the update and dump operations directly.\nS:U - The impact remains within the kernel/local host security authority and does not cross a VM, IOMMU, or separate security-scope boundary.\nC:H - Unsafe non-RCU list publication can make an RCU netlink dump interpret a transaction list head or freed transaction memory as `struct nft_hook`, leading to out-of-bounds/use-after-free reads returned through netlink hook device-name serialization.\nI:N - The reachable affected dump path reads hook-list entries and serializes names; I did not find a defensible attacker-controlled write or control-flow primitive from this bug.\nA:H - The malformed RCU traversal can dereference invalid/freed memory or loop over an inconsistent list, making kernel oops, panic, or soft lockup a plausible outcome."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:55:33.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed8d3bd8272e49ea987100de2abfb13710329a9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fdd2204503ab1ce07dc000c277e2c3edf96a67b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5593c640f9daedec8de61555c41e1019fa675aa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/00e370627f2e1fb3585f9d26348b1abddc75442b"
        },
        {
          "url": "https://git.kernel.org/stable/c/28ecfb3d1fe8dea70319de7051cb6718c25b5b52"
        },
        {
          "url": "https://git.kernel.org/stable/c/a557816c6e38e9473d99aa9ea8c662f55fc85847"
        },
        {
          "url": "https://git.kernel.org/stable/c/1346be9379639c30877083b12747d4eacb83c24f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6134e62dba2ea4f760b29d5226907f447c92400"
        }
      ],
      "title": "netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52988",
    "datePublished": "2026-06-24T16:29:02.580Z",
    "dateReserved": "2026-06-09T07:44:35.376Z",
    "dateUpdated": "2026-10-19T19:47:12.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifs_fs_sb.h",
            "fs/smb/client/cifsfs.c",
            "fs/smb/client/connect.c",
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7748b551010c021d92f0125e37f32ac0c376d8a",
              "status": "affected",
              "version": "0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd",
              "versionType": "git"
            },
            {
              "lessThan": "9fc87899276af941ecf3045798887db7deb85605",
              "status": "affected",
              "version": "f655467a9973f964b267871e5fef533ad5014494",
              "versionType": "git"
            },
            {
              "lessThan": "f0eac9c3c3711f24efc2aaf12b8ec3e54a38c214",
              "status": "affected",
              "version": "340cea84f691c5206561bb2e0147158fe02070be",
              "versionType": "git"
            },
            {
              "lessThan": "75f5c412fa867efa0bf9b646bffe0d912109e84a",
              "status": "affected",
              "version": "340cea84f691c5206561bb2e0147158fe02070be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "708c276f516d27beaded7f372ac8111cee43926c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0629a1a187e424373364d681b42b101894bdb548",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "30afc6ea72cc6cf7c8d579e79b64232801c38d08",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.112",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.54",
              "status": "affected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifs_fs_sb.h",
            "fs/smb/client/cifsfs.c",
            "fs/smb/client/connect.c",
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.18.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.167",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix busy dentry warning on unmount after DIO\n\nCommit c68337442f03 (\"cifs: Fix busy dentry used after unmounting\") fixed\nthe issue in cifs where deferred close of a file led to a dentry reference\ncount not being released in umount, by flushing deferredclose_wq in\ncifs_kill_sb() to solve it.\n\nHowever, the cifs DIO path suffers from the same busy-dentry problem caused\nby a delayed dentry reference-count release:\n\n\t[dio]\t\t\t[cifsd]\t\t\t[close + umount]\nnetfs_unbuffered_write_iter_locked\n...\n\t\t\t\tcifs_demultiplex_thread\n netfs_unbuffered_write\n  cifs_issue_write\n  netfs_wait_for_in_progress_stream [1]\n\t\t\t\t...\n\t\t\t\t netfs_write_subrequest_terminated\n\t\t\t\t  netfs_subreq_clear_in_progress\n\t\t\t\t   netfs_wake_collector // wake [1]\n\t\t\t\t  netfs_put_subrequest\n netfs_put_request\n  queue_work(system_dfl_wq, xxx) [2]\n // dio write return\t\t\t\t\tcifs_close\n\t\t\t\t\t\t\t _cifsFileInfo_put\n\t\t\t\t\t\t\t  // cfile-\u003ecount 2-\u003e1\n\t\t\t\t\t\t\t  --cfile-\u003ecount [3]\n\n\t\t\t\t\t\t\t// umount\n\t\t\t\t\t\t\tcifs_kill_sb\n\t\t\t\t\t\t\t kill_anon_super\n\t\t\t\t\t\t\t  // warning triggered!\n\t\t\t\t\t\t\t  shrink_dcache_for_umount [4]\n[system_dfl_wq] [5]\nnetfs_free_request\n ...\n _cifsFileInfo_put\n  // cfile-\u003ecount 1-\u003e0\n  --cfile-\u003ecount\n  queue_work(fileinfo_put_wq, xxx)\n\n[fileinfo_put_wq] [6]\ncifsFileInfo_put_work\n cifsFileInfo_put_final\n  dput\n\nIf the umount path is triggered before [5], it results warning:\nBUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test}  still in use (1)\n[unmount of cifs cifs]\n\nThe existing per-inode ictx-\u003eio_count wait in cifs_evict_inode() does not\nhelp: it lives in the inode eviction path, which runs after\nshrink_dcache_for_umount() has already warned about the busy dentries.\n\nFix it by adding a per-superblock outstanding-rreq counter that is\nincremented in cifs_init_request() and decremented in cifs_free_request().\nIn cifs_kill_sb(), before kill_anon_super(), wait for this counter to reach\n0 - which guarantees that all cleanup_work for this sb have run and thus\nall relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq.\nThen drain the workqueue so the dentry refs are dropped.\n\nThis is a targeted wait, not a flush of the system-wide system_dfl_wq."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached through local VFS syscalls (open with O_DIRECT, pwrite, close, umount) on the in-kernel CIFS/SMB3 client mount teardown path, not via remote SMB packet handling or ksmbd server code.\nAC:L - The attacker controls both sides of the race by issuing concurrent O_DIRECT writes and close/umount from separate threads, can flood system_dfl_wq to widen the cleanup delay window, and can retry until the post-pwrite/pre-cleanup_work window is hit.\nPR:L - Exploitation requires only a local user with write access to files on an already-mounted CIFS/SMB3 share; mount/umount can be performed by the same attacker with namespace capabilities or triggered by autofs lazy-unmount on shared enterprise home-directory mounts.\nUI:N - No victim interaction is required; the attacker directly drives the open/pwrite/close/umount syscall sequence in a tight loop without relying on another user to open files or perform any action.\nS:U - Impact is confined to kernel heap corruption and privilege escalation within the same host; this is not a VM escape, sandbox escape, or cross-security-authority boundary flaw.\nC:H - Delayed netfs cleanup causes cifsFileInfo_put_final() to dereference dentry, inode, and cifsInodeInfo structures after superblock teardown has begun, constituting a use-after-free that can be leveraged for arbitrary kernel memory read.\nI:H - Post-unmount cifsFileInfo_put_final() performs lock operations and list manipulation on freed kernel objects via fileinfo_put_wq, enabling heap metadata corruption and control-flow hijacking for arbitrary write or code execution.\nA:H - The race triggers WARN in shrink_dcache_for_umount during umount, and subsequent use-after-free in the deferred dentry put worker can cause kernel oops, panic, or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:55:48.520Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7748b551010c021d92f0125e37f32ac0c376d8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fc87899276af941ecf3045798887db7deb85605"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0eac9c3c3711f24efc2aaf12b8ec3e54a38c214"
        },
        {
          "url": "https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"
        }
      ],
      "title": "smb: client: fix busy dentry warning on unmount after DIO",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72315",
    "datePublished": "2026-08-15T05:55:29.761Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-10-03T10:55:48.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/xfrm4_input.c",
            "net/ipv6/xfrm6_input.c",
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fed4d3195a31125566876952ce66113ec1eb9008",
              "status": "affected",
              "version": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
              "versionType": "git"
            },
            {
              "lessThan": "1acd93259b6be269e26be5d71c224bccd1f8352f",
              "status": "affected",
              "version": "0f451b43c88bf2b9c038b414be580efee42e031b",
              "versionType": "git"
            },
            {
              "lessThan": "63a30015199912bd5055bead8001b1ae68a67cdb",
              "status": "affected",
              "version": "1c428b03840094410c5fb6a5db30640486bbbfcb",
              "versionType": "git"
            },
            {
              "lessThan": "8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff",
              "status": "affected",
              "version": "1c428b03840094410c5fb6a5db30640486bbbfcb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "94439cbe478b53f92223da9aae95fffb28623c3f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.112",
              "status": "affected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.54",
              "status": "affected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/xfrm4_input.c",
            "net/ipv6/xfrm6_input.c",
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.12.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.18.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.160",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Fix dev use-after-free in xfrm async resumption\n\nxfrm async resumption hold skb-\u003edev refcnt until after transport_finish.\nHowever, xfrm_rcv_cb may modify skb-\u003edev to tunnel dev without taking\ndevice reference, such as vti_rcv_cb. The subsequent async resumption\nwill decrement the tunnel device\u0027s reference count, which lead to uaf\nof tunnel dev and refcnt leak of orig dev as below:\n\nunregister_netdevice: waiting for vti1 to become free. Usage count = -2\n\nStash the original skb-\u003edev to fix refcnt imbalance. The new skb-\u003edev set\nby xfrm_rcv_cb can race with device teardown. Extend rcu protection over\nxfrm_rcv_cb and transport_finish to prevent races."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Reachable from the network receive path: remote ESP/AH (or UDP-encapsulated IPsec) packets hit ip_rcv \u2192 xfrm4/xfrm6 protocol handlers \u2192 vti/xfrmi input \u2192 xfrm_input() \u2192 async crypto resume, on Internet-facing IPsec/VTI/xfrmi VPN gateways and cloud endpoints.\nAC:L - Once async decryption resumes (encap_type=-1), vti_rcv_cb/xfrmi_rcv_cb retarget skb-\u003edev and the stale dev_put is deterministic; the attacker controls packet rate/volume to drive -EINPROGRESS and can race netdev teardown, so no uncontrollable victim-only conditions apply.\nPR:N - No local account, shell, or capability on the victim is required\u2014only network-delivered IPsec traffic accepted by a pre-configured VTI/xfrmi gateway (e.g., VPN peer, site-to-site endpoint); administrative IPsec setup is deployment state, not attacker privilege on the host.\nUI:N - Exploitation is fully automated by sending IPsec packets; no victim interaction such as mounting filesystems, opening files, or clicking links is needed.\nS:U - Impact is kernel net_device refcount corruption/UAF within the host kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel privilege escalation, not escape).\nC:H - Use-after-free of a net_device after refcount underflow (e.g., usage count=-2) exposes freed netdev/slab memory; per kernel UAF guidance this provides a high-impact arbitrary-read primitive via heap grooming.\nI:H - Corrupting freed net_device structures and reference counts is classic heap UAF that can be shaped into arbitrary kernel writes and control-flow hijack for code execution, per kernel memory-corruption guidance.\nA:H - Refcount imbalance causes unregister_netdevice to hang (usage count=-2), kernel oops/panic during tunnel teardown, and reliable denial of service on IPsec gateways even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:44:58.359Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fed4d3195a31125566876952ce66113ec1eb9008"
        },
        {
          "url": "https://git.kernel.org/stable/c/1acd93259b6be269e26be5d71c224bccd1f8352f"
        },
        {
          "url": "https://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"
        }
      ],
      "title": "xfrm: Fix dev use-after-free in xfrm async resumption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72463",
    "datePublished": "2026-08-15T05:57:07.413Z",
    "dateReserved": "2026-08-09T03:40:39.933Z",
    "dateUpdated": "2026-10-21T12:44:58.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74347",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:54:09.373919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:34.556Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_timeout.h",
            "net/netfilter/nf_conntrack_core.c",
            "net/netfilter/nf_conntrack_timeout.c",
            "net/netfilter/nfnetlink_cttimeout.c",
            "net/netfilter/nft_ct.c",
            "net/netfilter/xt_CT.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1241e459a1bd17044fa6bbb68f491ab5543c3a1b",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            },
            {
              "lessThan": "b2e84317f334d834fb06c9b340ea465f398b6d4f",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            },
            {
              "lessThan": "44583fd5735cb0bdf3bfe11b1e51504ce387bdb7",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            },
            {
              "lessThan": "9aeb0dcfeb460d33d61d434148b51103ab1d2013",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            },
            {
              "lessThan": "7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_timeout.h",
            "net/netfilter/nf_conntrack_core.c",
            "net/netfilter/nf_conntrack_timeout.c",
            "net/netfilter/nfnetlink_cttimeout.c",
            "net/netfilter/nft_ct.c",
            "net/netfilter/xt_CT.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: detach dataplane timeout policy and repurpose refcount\n\nAdd a refcount for struct nf_ct_timeout which is used by ct extension to\nset the custom ct timeout policy, this tells us that the ct timeout is\nbeing used by a conntrack entry. When the last conntrack entry drops the\nrefcount on the ct timeout, the ct timeout is released.\n\nRemove the refcount for control plane which controls if the ruleset\nrefers to the timeout policy. After this update, it is possible to\nremove the ct timeout policy from nfnetlink_cttimeout immediately.\nThis is for simplicity not to handle two refcounts on a single object.\n\nRemove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just\nhold a reference to the nf_ct_timeout object until packet is reinjected,\nsince this is part of the ct extension, this will be released by the\ntime the conntrack is freed.\n\nnf_ct_untimeout() is still called to clean up in a best effort basis:\nthe ct timeout on existing entries gets removed when the ct timeout goes\naway, but as long as the iptables ruleset still refers to the ct timeout\nthrough a template, new conntracks may keep attaching it and extend its\nlifetime until the rule is removed.\n\nnf_ct_untimeout() is not called anymore from module removal path, this\nis unlikely to find timeouts give module refcount is bumped, and the new\nrefcount already tracks the ct timeout policy use so it is released when\nunused."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires netlink control-plane operations (nfnetlink_cttimeout delete, nftables timeout object destroy, or iptables CT template removal) gated by CAP_NET_ADMIN; the UAF is exercised in local conntrack packet handling, not by unauthenticated remote packets alone.\nAC:L - An attacker with namespace admin can create timeout policies, drive concurrent conntrack traffic on multiple CPUs, and delete or replace the policy while packets still read it via RCU in nf_conntrack_tcp_packet; they control both teardown and dataplane readers.\nPR:L - All trigger paths require CAP_NET_ADMIN for nfnetlink/nftables/iptables configuration; netlink_net_capable() checks capability against the socket network namespace user_ns, so unprivileged local users can obtain it via user and network namespaces on common kernels.\nUI:N - No victim interaction is required; the attacker configures timeout policies, generates matching traffic, and tears down the policy while conntrack handlers still reference it, fully driving the race themselves.\nS:U - Impact is kernel heap corruption within the netfilter/conntrack subsystem of the same kernel security authority; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - This is a slab use-after-free of nf_ct_timeout objects still dereferenced through RCU in nf_ct_timeout_lookup() during TCP/UDP/SCTP conntrack handlers; freed objects can be reallocated to obtain arbitrary kernel memory read primitives.\nI:H - UAF of heap-allocated timeout policy data enables heap spraying and object replacement to corrupt adjacent structures or control flow, supporting arbitrary kernel write and local privilege escalation.\nA:H - Concurrent readers of freed timeout policy memory in nf_conntrack_tcp_packet and related handlers can trigger KASAN slab-use-after-free faults and kernel oops or panic, as demonstrated in the closely related nft_ct timeout destroy report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:45:25.907Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1241e459a1bd17044fa6bbb68f491ab5543c3a1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e84317f334d834fb06c9b340ea465f398b6d4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/44583fd5735cb0bdf3bfe11b1e51504ce387bdb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9aeb0dcfeb460d33d61d434148b51103ab1d2013"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549"
        }
      ],
      "title": "netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74347",
    "datePublished": "2026-08-15T05:58:35.287Z",
    "dateReserved": "2026-08-15T05:44:03.886Z",
    "dateUpdated": "2026-10-21T12:45:25.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4892be1ef0bbe6db6b13bf46cb79b6706bb5b214",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "388f471ca4758f644394b681ce97677a4d0e772c",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "9e5abb5e2ade0b6fd0e47209711115d47a255176",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "6be59da2063d5b3522bfde8aae0487ec095eb384",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "13b3c29a782033ce4a230be9e5618032813dbcd4",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy\n\nmt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block\ncopy from the address reported by the MCU response (event-\u003eaddr, a\ndevice-controlled __le32) and clamps only the copy length, never the\ndestination offset into dev-\u003emt76.eeprom.data. A malicious or\nmalfunctioning device can report an arbitrary address and drive an\nout-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past\neeprom.data.\n\nReject a response whose address would place the copy outside eeprom.data\nbefore deriving the destination pointer. Devices that echo the requested\nin-bounds offset are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The OOB copy is driven by a MediaTek Wi-Fi 7 MCU EEPROM query response (mt7996/mt7992/mt7990), not a routed IP service; the highest reasonable exposure is an adjacent attacker who can drive malicious firmware or device behavior on the local radio.\nAC:L - A malicious MCU response can set event-\u003evalid and an arbitrary event-\u003eaddr; the host then memcpy\u0027s up to MT7996_EXT_EEPROM_BLOCK_SIZE (1024) device-controlled bytes to eeprom.data+addr with no race or other condition beyond attacker control.\nPR:N - MCU EEPROM responses are consumed in mt7996_eeprom_load() during driver bring-up with no OS credential, capability, or Wi-Fi authentication check; an adjacent attacker needs no local account.\nUI:N - The copy runs automatically in mt7996_eeprom_load() during pci_probe/register after firmware load; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The write corrupts host kernel heap around the mt76 EEPROM buffer and is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other crossed security authority.\nC:H - Attacker-controlled destination offset and payload are kernel memory corruption that can overwrite adjacent objects and pointers and be leveraged for information disclosure, so confidentiality impact is high.\nI:H - Up to 1024 bytes of device-controlled data are written at a device-chosen offset past the 7680-byte eeprom.data allocation, an out-of-bounds write primitive that can yield arbitrary kernel writes or control-flow hijacking.\nA:H - An unbounded kernel heap write during EEPROM init can oops, panic, or hang the host, a high availability impact on Wi-Fi 7 APs, routers, and workstations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:15.492Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4892be1ef0bbe6db6b13bf46cb79b6706bb5b214"
        },
        {
          "url": "https://git.kernel.org/stable/c/388f471ca4758f644394b681ce97677a4d0e772c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e5abb5e2ade0b6fd0e47209711115d47a255176"
        },
        {
          "url": "https://git.kernel.org/stable/c/6be59da2063d5b3522bfde8aae0487ec095eb384"
        },
        {
          "url": "https://git.kernel.org/stable/c/13b3c29a782033ce4a230be9e5618032813dbcd4"
        }
      ],
      "title": "wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80935",
    "datePublished": "2026-09-11T19:42:09.286Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-10-21T12:47:15.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6774f6af3711143a93281904a928a78652c8b7e",
              "status": "affected",
              "version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
              "versionType": "git"
            },
            {
              "lessThan": "394e8cb56fc732d71041599cdb4e01f82cfd11c5",
              "status": "affected",
              "version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
              "versionType": "git"
            },
            {
              "lessThan": "5fdaf7016d7684ef756a229fd5d96b4a140eeb40",
              "status": "affected",
              "version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
              "versionType": "git"
            },
            {
              "lessThan": "5f48b0d752a76590e2c613aae5345c2474627d1b",
              "status": "affected",
              "version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
              "versionType": "git"
            },
            {
              "lessThan": "44b5adfe49499f53002737f5fe81d608c08122fc",
              "status": "affected",
              "version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy\n\nmt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver\u0027s\ndev-\u003emt76.eeprom.data buffer at the offset reported by the MCU response\n(res-\u003eaddr, a device-controlled __le32) without checking it against the\nbuffer size. A malicious or malfunctioning device can report an arbitrary\naddress and drive a 16-byte out-of-bounds write past eeprom.data.\n\nReject a response whose address would place the copy outside eeprom.data\nbefore deriving the destination pointer. Devices that echo the requested\nin-bounds offset are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The OOB write is driven by a MediaTek Wi-Fi 6 MCU EFUSE query response (mt7915/mt7916/mt7981/mt7986), not a routed IP service; the highest reasonable exposure is an adjacent attacker who can drive malicious firmware or device behavior on the local radio.\nAC:L - A malicious MCU response can set an arbitrary res-\u003eaddr and 16 device-controlled payload bytes; the host then memcpy\u0027s MT7915_EEPROM_BLOCK_SIZE bytes to eeprom.data+addr with no race or other condition beyond attacker control.\nPR:N - MCU EEPROM responses are consumed in mt7915_eeprom_load() during driver bring-up with no OS credential, capability, or Wi-Fi authentication check; an adjacent attacker needs no local account.\nUI:N - The copy runs automatically in mt7915_eeprom_load() during pci_probe/platform probe after firmware load; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The write corrupts host kernel heap around the mt76 EEPROM buffer and is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other crossed security authority.\nC:H - Attacker-controlled destination offset and payload are kernel memory corruption that can overwrite adjacent objects and pointers and be leveraged for information disclosure, so confidentiality impact is high.\nI:H - Sixteen bytes of device-controlled data are written at a device-chosen offset past the 3584/4096-byte eeprom.data allocation, an out-of-bounds write primitive that can yield arbitrary kernel writes or control-flow hijacking.\nA:H - An unbounded kernel heap write during EEPROM init can oops, panic, or hang the host, a high availability impact on Wi-Fi 6 APs, routers, and workstations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:16.610Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6774f6af3711143a93281904a928a78652c8b7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/394e8cb56fc732d71041599cdb4e01f82cfd11c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fdaf7016d7684ef756a229fd5d96b4a140eeb40"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f48b0d752a76590e2c613aae5345c2474627d1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/44b5adfe49499f53002737f5fe81d608c08122fc"
        }
      ],
      "title": "wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80937",
    "datePublished": "2026-09-11T19:42:10.822Z",
    "dateReserved": "2026-08-26T14:34:25.803Z",
    "dateUpdated": "2026-10-21T12:47:16.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/core.h",
            "drivers/net/wireless/realtek/rtw89/mac80211.c",
            "drivers/net/wireless/realtek/rtw89/pci.c",
            "drivers/net/wireless/realtek/rtw89/pci.h",
            "drivers/net/wireless/realtek/rtw89/rtw8851be.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852ae.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852be.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852bte.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852ce.c",
            "drivers/net/wireless/realtek/rtw89/rtw8922ae.c",
            "drivers/net/wireless/realtek/rtw89/rtw8922de.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dfe2b5b2056918d186ad890079a9e7ec1898429a",
              "status": "affected",
              "version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
              "versionType": "git"
            },
            {
              "lessThan": "9693980cd7d2f5b17e5ef5922b922f2e1a770fca",
              "status": "affected",
              "version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
              "versionType": "git"
            },
            {
              "lessThan": "c1f214dd1351244156deb57761b14190a233aef6",
              "status": "affected",
              "version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
              "versionType": "git"
            },
            {
              "lessThan": "667c12782aaf8dd3cb2213e528fe63a73cb63345",
              "status": "affected",
              "version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/core.h",
            "drivers/net/wireless/realtek/rtw89/mac80211.c",
            "drivers/net/wireless/realtek/rtw89/pci.c",
            "drivers/net/wireless/realtek/rtw89/pci.h",
            "drivers/net/wireless/realtek/rtw89/rtw8851be.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852ae.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852be.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852bte.c",
            "drivers/net/wireless/realtek/rtw89/rtw8852ce.c",
            "drivers/net/wireless/realtek/rtw89/rtw8922ae.c",
            "drivers/net/wireless/realtek/rtw89/rtw8922de.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot\n\nSince the hardware rfkill polling was introduced, arm64 platforms can\npanic with an asynchronous SError during warm reboot:\n\n  SError Interrupt on CPU8, code 0x00000000be000011 -- SError\n  Workqueue: events_power_efficient rfkill_poll [rfkill]\n    rtw89_pci_ops_read8+0x94/0x160 [rtw89_pci]\n    rtw89_core_rfkill_poll+0x50/0x1e0 [rtw89_core]\n    rtw89_ops_rfkill_poll+0x40/0x68 [rtw89_core]\n    ieee80211_rfkill_poll+0x3c/0x70 [mac80211]\n    cfg80211_rfkill_poll+0x40/0x2a0 [cfg80211]\n    rfkill_poll+0x30/0x88 [rfkill]\n  Kernel panic - not syncing: Asynchronous SError Interrupt\n\nOn the reboot path the kernel only runs device_shutdown(), which calls\neach driver\u0027s .shutdown callback; .remove is not invoked.  The rtw89 PCI\ndriver had no .shutdown callback, so nothing stopped the rfkill polling\nwork while the platform was tearing the PCIe link down.  Once the link\nis gone, the next MMIO read from the poll handler targets a\nnon-responding device and is reported as a fatal asynchronous SError on\narm64.\n\nAdd rtw89_pci_shutdown(), wired to all rtw89 PCI device drivers, which\nsets a new RTW89_FLAG_SHUTDOWN flag (mirroring the USB\nRTW89_FLAG_UNPLUGGED pattern).  When the flag is set,\nrtw89_ops_rfkill_poll() returns early, so no MMIO read is issued to the\nchip after shutdown begins and the SError no longer occurs.\n\nThis does not call the full .remove path from .shutdown, to keep the\nshutdown handler minimal and avoid running the non-idempotent teardown\ntwice."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:45:23.179Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dfe2b5b2056918d186ad890079a9e7ec1898429a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9693980cd7d2f5b17e5ef5922b922f2e1a770fca"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1f214dd1351244156deb57761b14190a233aef6"
        },
        {
          "url": "https://git.kernel.org/stable/c/667c12782aaf8dd3cb2213e528fe63a73cb63345"
        }
      ],
      "title": "wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80939",
    "datePublished": "2026-09-11T19:42:12.340Z",
    "dateReserved": "2026-08-26T14:34:25.803Z",
    "dateUpdated": "2026-10-19T08:45:23.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80980",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:21:47.866329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:37.381Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            },
            {
              "lessThan": "09a9cbadc05f452405de31012bd2c428b601291a",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            },
            {
              "lessThan": "313f79149eb337411c64e2c247234b62ef9a3cb9",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            },
            {
              "lessThan": "2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            },
            {
              "lessThan": "db51a8658c11a82432b64999519a269c3aabb447",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n    u8  killed : 1;\n    u8  freed : 1;\n    u8  out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - smc_cdc_msg_validate() runs from the SMC-R CDC receive tasklet on RDMA completions, and teardown is driven by CLC DECLINE (FIRST_CONTACT) or LLC DELETE_LINK_ALL from the same peer. SMC-Rv2 is RoCEv2 over UDP/4791 (IP-routable) with the CLC handshake on plain TCP, so a remote host that can reach an AF_SMC listener hits the path.\nAC:L - The attacker controls both sides of the race: it sends CDC failover_validation messages that store out_of_sync from the receive tasklet (no sock lock) while concurrently forcing smc_conn_kill()/smc_conn_free() via CLC decline, CDC close/abort, or LLC link-delete, and can retry across many connections in the same link group.\nPR:N - SMC has no peer authentication. Completing the CLC handshake to a listening AF_SMC/IPPROTO_SMC socket and sending CDC/CLC/LLC messages requires no credentials, capabilities, or local account, matching other SMC remote bugs.\nUI:N - CDC is processed in a softirq tasklet from the RDMA completion queue and CLC decline is handled in the handshake worker; no local user or application action is required beyond the already-listening SMC server.\nS:U - The corrupted flags and resulting UAF stay inside kernel objects (smc_connection, smc_sock, smc_link_group) in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A lost killed/freed/out_of_sync bit from the shared-byte RMW lets CDC continue after unregister or lets smc_conn_free() run twice (duplicate smc_lgr_put), a use-after-free of the socket and link group that can be reallocated to disclose kernel memory.\nI:H - The same UAF/double-free writes through a reused smc_sock (sk_err, sk_data_ready, queue_work on abort_work/close_work) and link-group refcounts, giving heap-spray primitives for arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free and double-free of the connection and link group oops or panic in softirq/workqueue context (refcount underflow, as in related SMC UAFs), and the attacker can trigger it repeatedly without authentication."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:21.045Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/09a9cbadc05f452405de31012bd2c428b601291a"
        },
        {
          "url": "https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec"
        },
        {
          "url": "https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447"
        }
      ],
      "title": "net/smc: stop killed, freed and out_of_sync sharing a byte",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80980",
    "datePublished": "2026-09-11T19:42:40.832Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-10-21T12:47:21.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}