Vulnerability-Lookup

RHSA-2025:8056

Vulnerability from csaf_opensuse - Published: 2025-05-21 00:00 - Updated: 2026-09-20 11:55

Summary

security update for kernel

Severity

Important

Notes

Title of the patch: security update for kernel

Description of the patch: This security update provides a functional equivalent of RHSA-2025:8056. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:8056.

Patchnames: RHSA-2025:8056

CVE-2024-40906

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2024-44970

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products, the same list as for CVE-2024-40906

Threats

Impact moderate

CVE-2025-21756

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2024-40906

Threats

Impact important

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-40906/	self
https://www.suse.com/security/cve/CVE-2024-44970/	self
https://www.suse.com/security/cve/CVE-2025-21756/	self
https://www.suse.com/security/cve/CVE-2024-40906	external
https://bugzilla.suse.com/1227763	external
https://www.suse.com/security/cve/CVE-2024-44970	external
https://bugzilla.suse.com/1230209	external
https://www.suse.com/security/cve/CVE-2025-21756	external
https://bugzilla.suse.com/1238876	external
https://bugzilla.suse.com/1245795	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2025:8056.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2025:8056.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2025:8056",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_8056.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2025:8056",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-May/001155.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2025:8056",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-May/001155.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-40906 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-40906/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44970 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44970/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-21756 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-21756/"
      }
    ],
    "title": "security update for kernel",
    "tracking": {
      "current_release_date": "2026-09-20T11:55:26Z",
      "generator": {
        "date": "2025-05-21T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2025:8056",
      "initial_release_date": "2025-05-21T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-05-21T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:55:26Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
                "product": {
                  "name": "kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
                  "product_id": "kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-abi-stablelists@4.18.0-553.53.1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
                "product": {
                  "name": "kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
                  "product_id": "kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-doc@4.18.0-553.53.1.el8_10?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bpftool@4.18.0-553.53.1.el8_10?arch=x86_64\u0026upstream=bpftool-0:4.18.0-553.53.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-core@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-cross-headers@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug@4.18.0-553.53.1.el8_10?arch=x86_64\u0026upstream=kernel-debug-0:4.18.0-553.53.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-core@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug-devel@4.18.0-553.53.1.el8_10?arch=x86_64\u0026upstream=kernel-debug-0:4.18.0-553.53.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-modules@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-modules-extra@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@4.18.0-553.53.1.el8_10?arch=x86_64\u0026upstream=kernel-source-0:4.18.0-553.53.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-headers@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-modules@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-modules-extra@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs-devel@4.18.0-553.53.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perf-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "perf-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "perf-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perf@4.18.0-553.53.1.el8_10?arch=x86_64\u0026upstream=perf-0:4.18.0-553.53.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-perf-0:4.18.0-553.53.1.el8_10.x86_64",
                "product": {
                  "name": "python3-perf-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_id": "python3-perf-0:4.18.0-553.53.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python3-perf@4.18.0-553.53.1.el8_10?arch=x86_64\u0026upstream=perf-0:4.18.0-553.53.1.el8_10.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bpftool-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch"
        },
        "product_reference": "kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-core-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-doc-0:4.18.0-553.53.1.el8_10.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch"
        },
        "product_reference": "kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perf-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "perf-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-perf-0:4.18.0-553.53.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
        },
        "product_reference": "python3-perf-0:4.18.0-553.53.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-40906",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-40906"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Always stop health timer during driver removal\n\nCurrently, if teardown_hca fails to execute during driver removal, mlx5\ndoes not stop the health timer. Afterwards, mlx5 continue with driver\nteardown. This may lead to a UAF bug, which results in page fault\nOops[1], since the health timer invokes after resources were freed.\n\nHence, stop the health monitor even if teardown_hca fails.\n\n[1]\nmlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: cleanup\nmlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource\nmlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup\nBUG: unable to handle page fault for address: ffffa26487064230\nPGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE     -------  ---  6.7.0-68.fc38.x86_64 #1\nHardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020\nRIP: 0010:ioread32be+0x34/0x60\nRSP: 0018:ffffa26480003e58 EFLAGS: 00010292\nRAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0\nRDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230\nRBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8\nR10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0\nR13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0\nFS:  0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? exc_page_fault+0x175/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n ? ioread32be+0x34/0x60\n mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core]\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n poll_health+0x42/0x230 [mlx5_core]\n ? __next_timer_interrupt+0xbc/0x110\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n call_timer_fn+0x21/0x130\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n __run_timers+0x222/0x2c0\n run_timer_softirq+0x1d/0x40\n __do_softirq+0xc9/0x2c8\n __irq_exit_rcu+0xa6/0xc0\n sysvec_apic_timer_interrupt+0x72/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\nRIP: 0010:cpuidle_enter_state+0xcc/0x440\n ? cpuidle_enter_state+0xbd/0x440\n cpuidle_enter+0x2d/0x40\n do_idle+0x20d/0x270\n cpu_startup_entry+0x2a/0x30\n rest_init+0xd0/0xd0\n arch_call_rest_init+0xe/0x30\n start_kernel+0x709/0xa90\n x86_64_start_reservations+0x18/0x30\n x86_64_start_kernel+0x96/0xa0\n secondary_startup_64_no_verify+0x18f/0x19b\n---[ end trace 0000000000000000 ]---",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-40906",
          "url": "https://www.suse.com/security/cve/CVE-2024-40906"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227763 for CVE-2024-40906",
          "url": "https://bugzilla.suse.com/1227763"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-40906"
    },
    {
      "cve": "CVE-2024-44970",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44970"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\n\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\nto receive CQEs with 0 consumed strides for the same WQE even after the\nWQE is fully consumed and unlinked. This triggers an additional unlink\nfor the same wqe which corrupts the linked list.\n\nFix this scenario by accepting 0 sized consumed strides without\nunlinking the WQE again.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44970",
          "url": "https://www.suse.com/security/cve/CVE-2024-44970"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1230209 for CVE-2024-44970",
          "url": "https://bugzilla.suse.com/1230209"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-44970"
    },
    {
      "cve": "CVE-2025-21756",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-21756"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Keep the binding until socket destruction\n\nPreserve sockets bindings; this includes both resulting from an explicit\nbind() and those implicitly bound through autobind during connect().\n\nPrevents socket unbinding during a transport reassignment, which fixes a\nuse-after-free:\n\n    1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)\n    2. transport-\u003erelease() calls vsock_remove_bound() without checking if\n       sk was bound and moved to bound list (refcnt=1)\n    3. vsock_bind() assumes sk is in unbound list and before\n       __vsock_insert_bound(vsock_bound_sockets()) calls\n       __vsock_remove_bound() which does:\n           list_del_init(\u0026vsk-\u003ebound_table); // nop\n           sock_put(\u0026vsk-\u003esk);               // refcnt=0\n\nBUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730\nRead of size 4 at addr ffff88816b46a74c by task a.out/2057\n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n __vsock_bind+0x62e/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nAllocated by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n __vsock_create.constprop.0+0x2e/0xb60\n vsock_create+0xe4/0x420\n __sock_create+0x241/0x650\n __sys_socket+0xf2/0x1a0\n __x64_sys_socket+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n __vsock_bind+0x5e1/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150\nRIP: 0010:refcount_warn_saturate+0xce/0x150\n __vsock_bind+0x66d/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150\nRIP: 0010:refcount_warn_saturate+0xee/0x150\n vsock_remove_bound+0x187/0x1e0\n __vsock_release+0x383/0x4a0\n vsock_release+0x90/0x120\n __sock_release+0xa3/0x250\n sock_close+0x14/0x20\n __fput+0x359/0xa80\n task_work_run+0x107/0x1d0\n do_exit+0x847/0x2560\n do_group_exit+0xb8/0x250\n __x64_sys_exit_group+0x3a/0x50\n x64_sys_call+0xfec/0x14f0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-21756",
          "url": "https://www.suse.com/security/cve/CVE-2025-21756"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238876 for CVE-2025-21756",
          "url": "https://bugzilla.suse.com/1238876"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245795 for CVE-2025-21756",
          "url": "https://bugzilla.suse.com/1245795"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.53.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.53.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.53.1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-21756"
    }
  ]
}

CVE-2024-40906 (GCVE-0-2024-40906)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:20 – Updated: 2026-05-11 20:22

Title

net/mlx5: Always stop health timer during driver removal

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop health timer during driver removal Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwards, mlx5 continue with driver teardown. This may lead to a UAF bug, which results in page fault Oops[1], since the health timer invokes after resources were freed. Hence, stop the health monitor even if teardown_hca fails. [1] mlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: cleanup mlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource mlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup BUG: unable to handle page fault for address: ffffa26487064230 PGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE ------- --- 6.7.0-68.fc38.x86_64 #1 Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020 RIP: 0010:ioread32be+0x34/0x60 RSP: 0018:ffffa26480003e58 EFLAGS: 00010292 RAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0 RDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230 RBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8 R10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0 R13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0 FS: 0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x175/0x180 ? asm_exc_page_fault+0x26/0x30 ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? ioread32be+0x34/0x60 mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] poll_health+0x42/0x230 [mlx5_core] ? __next_timer_interrupt+0xbc/0x110 ? __pfx_poll_health+0x10/0x10 [mlx5_core] call_timer_fn+0x21/0x130 ? __pfx_poll_health+0x10/0x10 [mlx5_core] __run_timers+0x222/0x2c0 run_timer_softirq+0x1d/0x40 __do_softirq+0xc9/0x2c8 __irq_exit_rcu+0xa6/0xc0 sysvec_apic_timer_interrupt+0x72/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:cpuidle_enter_state+0xcc/0x440 ? cpuidle_enter_state+0xbd/0x440 cpuidle_enter+0x2d/0x40 do_idle+0x20d/0x270 cpu_startup_entry+0x2a/0x30 rest_init+0xd0/0xd0 arch_call_rest_init+0xe/0x30 start_kernel+0x709/0xa90 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x96/0xa0 secondary_startup_64_no_verify+0x18f/0x19b ---[ end trace 0000000000000000 ]---

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:06 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/e7d4485d47839f4d1…
https://git.kernel.org/stable/c/6ccada6ffb42e0ac7…
https://git.kernel.org/stable/c/e6777ae0bf6fd5bc6…
https://git.kernel.org/stable/c/c8b3f38d2dae03979…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < e7d4485d47839f4d1284592ae242c4e65b2810a9 (git) Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < 6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a (git) Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8 (git) Affected: 9b98d395b85dd042fe83fb696b1ac02e6c93a520 , < c8b3f38d2dae0397944814d691a419c451f9906f (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.95 , ≤ 6.1.* (semver) Unaffected: 6.6.35 , ≤ 6.6.* (semver) Unaffected: 6.9.6 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:36.228Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40906",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:06:18.717669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:38.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7d4485d47839f4d1284592ae242c4e65b2810a9",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            },
            {
              "lessThan": "6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            },
            {
              "lessThan": "e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            },
            {
              "lessThan": "c8b3f38d2dae0397944814d691a419c451f9906f",
              "status": "affected",
              "version": "9b98d395b85dd042fe83fb696b1ac02e6c93a520",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Always stop health timer during driver removal\n\nCurrently, if teardown_hca fails to execute during driver removal, mlx5\ndoes not stop the health timer. Afterwards, mlx5 continue with driver\nteardown. This may lead to a UAF bug, which results in page fault\nOops[1], since the health timer invokes after resources were freed.\n\nHence, stop the health monitor even if teardown_hca fails.\n\n[1]\nmlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\nmlx5_core 0000:18:00.0: E-Switch: cleanup\nmlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource\nmlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup\nBUG: unable to handle page fault for address: ffffa26487064230\nPGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE     -------  ---  6.7.0-68.fc38.x86_64 #1\nHardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020\nRIP: 0010:ioread32be+0x34/0x60\nRSP: 0018:ffffa26480003e58 EFLAGS: 00010292\nRAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0\nRDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230\nRBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8\nR10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0\nR13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0\nFS:  0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? exc_page_fault+0x175/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n ? ioread32be+0x34/0x60\n mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core]\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n poll_health+0x42/0x230 [mlx5_core]\n ? __next_timer_interrupt+0xbc/0x110\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n call_timer_fn+0x21/0x130\n ? __pfx_poll_health+0x10/0x10 [mlx5_core]\n __run_timers+0x222/0x2c0\n run_timer_softirq+0x1d/0x40\n __do_softirq+0xc9/0x2c8\n __irq_exit_rcu+0xa6/0xc0\n sysvec_apic_timer_interrupt+0x72/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\nRIP: 0010:cpuidle_enter_state+0xcc/0x440\n ? cpuidle_enter_state+0xbd/0x440\n cpuidle_enter+0x2d/0x40\n do_idle+0x20d/0x270\n cpu_startup_entry+0x2a/0x30\n rest_init+0xd0/0xd0\n arch_call_rest_init+0xe/0x30\n start_kernel+0x709/0xa90\n x86_64_start_reservations+0x18/0x30\n x86_64_start_kernel+0x96/0xa0\n secondary_startup_64_no_verify+0x18f/0x19b\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:22:06.884Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7d4485d47839f4d1284592ae242c4e65b2810a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ccada6ffb42e0ac75e3db06d41baf5a7f483f8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6777ae0bf6fd5bc626bb051c8c93e3c8198a3f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8b3f38d2dae0397944814d691a419c451f9906f"
        }
      ],
      "title": "net/mlx5: Always stop health timer during driver removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40906",
    "datePublished": "2024-07-12T12:20:46.485Z",
    "dateReserved": "2024-07-12T12:17:45.580Z",
    "dateUpdated": "2026-05-11T20:22:06.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44970 (GCVE-0-2024-44970)

Vulnerability from cvelistv5 – Published: 2024-09-04 18:56 – Updated: 2026-08-05 11:37

Title

net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:39 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/7b379353e9144e1f7…
https://git.kernel.org/stable/c/650e24748e1e0a7ff…
https://git.kernel.org/stable/c/50d8009a0ac02c331…
https://git.kernel.org/stable/c/fba8334721e266f92…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f97d5c2a453e26071e3b0ec12161de57c4a237c4 , < 7b379353e9144e1f7460ff15f39862012c9d0d78 (git) Affected: f97d5c2a453e26071e3b0ec12161de57c4a237c4 , < 650e24748e1e0a7ff91d5c72b72a2f2a452b5b76 (git) Affected: f97d5c2a453e26071e3b0ec12161de57c4a237c4 , < 50d8009a0ac02c3311b23a0066511f8337bd88d9 (git) Affected: f97d5c2a453e26071e3b0ec12161de57c4a237c4 , < fba8334721e266f92079632598e46e5f89082f30 (git)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.105 , ≤ 6.1.* (semver) Unaffected: 6.6.46 , ≤ 6.6.* (semver) Unaffected: 6.10.5 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44970",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:39:17.730265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:34.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:14:21.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b379353e9144e1f7460ff15f39862012c9d0d78",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            },
            {
              "lessThan": "650e24748e1e0a7ff91d5c72b72a2f2a452b5b76",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            },
            {
              "lessThan": "50d8009a0ac02c3311b23a0066511f8337bd88d9",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            },
            {
              "lessThan": "fba8334721e266f92079632598e46e5f89082f30",
              "status": "affected",
              "version": "f97d5c2a453e26071e3b0ec12161de57c4a237c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.105",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.46",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\n\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\nto receive CQEs with 0 consumed strides for the same WQE even after the\nWQE is fully consumed and unlinked. This triggers an additional unlink\nfor the same wqe which corrupts the linked list.\n\nFix this scenario by accepting 0 sized consumed strides without\nunlinking the WQE again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the mlx5e RX completion handler, driven entirely by CQEs the NIC generates while receiving packets from the wire; a remote, routable attacker sending TCP traffic to the host reaches it with no local access. This is the network stack\u0027s receive path, not a syscall or ioctl interface.\nAC:L - The attacker controls the entire traffic pattern (flow count, segment sizes, session-flush triggers, packet rate) that drives SHAMPO coalescing to WQE boundaries, and can sustain it at line rate indefinitely, so the zero-consumed-strides CQE condition is hit repeatedly and reliably. There is no race against an uncontrolled party and no memory-layout precondition for the trigger.\nPR:N - No account, credentials, or authentication of any kind are required \u2014 the corruption happens in the NAPI RX completion path before any socket or protocol authorization layer is consulted. The attacker only needs to send packets that the NIC receives.\nUI:N - Packet processing happens automatically in the driver\u0027s NAPI poll; no administrator or user action is needed once the interface is up and receiving traffic.\nS:U - The corrupted WQ linked list, the underflowed cur_sz counter, and the prematurely released page-pool pages all belong to the host kernel\u0027s own RX ring. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The self-referencing free list and cur_sz underflow cause page-pool pages to be released while still referenced by outstanding hardware descriptors and in-flight skbs, so recycled kernel memory contents can be cross-attributed into packets delivered up the stack to userspace. Memory corruption of this class provides an arbitrary kernel-memory disclosure primitive.\nI:H - After the free-list self-loop stalls head advancement, mlx5e_post_rx_mpwqes() releases pages for which a UMR and RX WQE were already posted, so the NIC keeps DMA\u0027ing fully attacker-controlled packet bytes into freed and reallocated kernel pages \u2014 an arbitrary-content write into reused kernel memory, leverageable for control-flow hijacking. The driver additionally writes through a stale tail_next pointer.\nA:H - The corrupted linked list permanently stalls RQ replenishment and loses network connectivity, and the teardown path (mlx5e_free_rx_descs on link down, MTU change, or RQ recovery) spins re-deallocating the same WQE up to 65535 times, driving page refcount underflow and kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:22.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78"
        },
        {
          "url": "https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76"
        },
        {
          "url": "https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30"
        }
      ],
      "title": "net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44970",
    "datePublished": "2024-09-04T18:56:46.807Z",
    "dateReserved": "2024-08-21T05:34:56.667Z",
    "dateUpdated": "2026-08-05T11:37:22.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21756 (GCVE-0-2025-21756)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54

Title

vsock: Keep the binding until socket destruction

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). Prevents socket unbinding during a transport reassignment, which fixes a use-after-free: 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2) 2. transport->release() calls vsock_remove_bound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vsock_bind() assumes sk is in unbound list and before __vsock_insert_bound(vsock_bound_sockets()) calls __vsock_remove_bound() which does: list_del_init(&vsk->bound_table); // nop sock_put(&vsk->sk); // refcnt=0 BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057 dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 __vsock_bind+0x62e/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 __vsock_create.constprop.0+0x2e/0xb60 vsock_create+0xe4/0x420 __sock_create+0x241/0x650 __sys_socket+0xf2/0x1a0 __x64_sys_socket+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 __vsock_bind+0x5e1/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 RIP: 0010:refcount_warn_saturate+0xce/0x150 __vsock_bind+0x66d/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 RIP: 0010:refcount_warn_saturate+0xee/0x150 vsock_remove_bound+0x187/0x1e0 __vsock_release+0x383/0x4a0 vsock_release+0x90/0x120 __sock_release+0xa3/0x250 sock_close+0x14/0x20 __fput+0x359/0xa80 task_work_run+0x107/0x1d0 do_exit+0x847/0x2560 do_group_exit+0xb8/0x250 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0xfec/0x14f0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-14 21:01 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e7754d564579a5db9…
https://git.kernel.org/stable/c/e48fcb403c2d0e574…
https://git.kernel.org/stable/c/42b33381e5e1f2b96…
https://git.kernel.org/stable/c/3f43540166128951c…
https://git.kernel.org/stable/c/645ce25aa0e67895b…
https://git.kernel.org/stable/c/b1afd40321f1c243c…
https://git.kernel.org/stable/c/fcdd2242c0231032f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < e7754d564579a5db9c5c9f74228df5d6dd6f1173 (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < e48fcb403c2d0e574c19683f09399ab4cf67809c (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < 42b33381e5e1f2b967dc4fb4221ddb9aaf10d197 (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < 3f43540166128951cc1be7ab1ce6b7f05c670d8b (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < 645ce25aa0e67895b11d89f27bb86c9d444c40f8 (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < b1afd40321f1c243cffbcf40ea7ca41aca87fa5e (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < fcdd2242c0231032fc84e1404315c245ae56322a (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.131 , ≤ 6.1.* (semver) Unaffected: 6.6.79 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21756",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T21:01:56.187542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T21:02:02.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:01.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:39:57.826Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7754d564579a5db9c5c9f74228df5d6dd6f1173",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "e48fcb403c2d0e574c19683f09399ab4cf67809c",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "42b33381e5e1f2b967dc4fb4221ddb9aaf10d197",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "3f43540166128951cc1be7ab1ce6b7f05c670d8b",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "645ce25aa0e67895b11d89f27bb86c9d444c40f8",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "b1afd40321f1c243cffbcf40ea7ca41aca87fa5e",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "fcdd2242c0231032fc84e1404315c245ae56322a",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.131",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Keep the binding until socket destruction\n\nPreserve sockets bindings; this includes both resulting from an explicit\nbind() and those implicitly bound through autobind during connect().\n\nPrevents socket unbinding during a transport reassignment, which fixes a\nuse-after-free:\n\n    1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)\n    2. transport-\u003erelease() calls vsock_remove_bound() without checking if\n       sk was bound and moved to bound list (refcnt=1)\n    3. vsock_bind() assumes sk is in unbound list and before\n       __vsock_insert_bound(vsock_bound_sockets()) calls\n       __vsock_remove_bound() which does:\n           list_del_init(\u0026vsk-\u003ebound_table); // nop\n           sock_put(\u0026vsk-\u003esk);               // refcnt=0\n\nBUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730\nRead of size 4 at addr ffff88816b46a74c by task a.out/2057\n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n __vsock_bind+0x62e/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nAllocated by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n __vsock_create.constprop.0+0x2e/0xb60\n vsock_create+0xe4/0x420\n __sock_create+0x241/0x650\n __sys_socket+0xf2/0x1a0\n __x64_sys_socket+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n __vsock_bind+0x5e1/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150\nRIP: 0010:refcount_warn_saturate+0xce/0x150\n __vsock_bind+0x66d/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150\nRIP: 0010:refcount_warn_saturate+0xee/0x150\n vsock_remove_bound+0x187/0x1e0\n __vsock_release+0x383/0x4a0\n vsock_release+0x90/0x120\n __sock_release+0xa3/0x250\n sock_close+0x14/0x20\n __fput+0x359/0xa80\n task_work_run+0x107/0x1d0\n do_exit+0x847/0x2560\n do_group_exit+0xb8/0x250\n __x64_sys_exit_group+0x3a/0x50\n x64_sys_call+0xfec/0x14f0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "Deterministic UAF in vsock socket binding during transport reassignment. connect() unbinds the socket dropping refcount, then bind() triggers use-after-free exploitable for privilege escalation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:09.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7754d564579a5db9c5c9f74228df5d6dd6f1173"
        },
        {
          "url": "https://git.kernel.org/stable/c/e48fcb403c2d0e574c19683f09399ab4cf67809c"
        },
        {
          "url": "https://git.kernel.org/stable/c/42b33381e5e1f2b967dc4fb4221ddb9aaf10d197"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f43540166128951cc1be7ab1ce6b7f05c670d8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/645ce25aa0e67895b11d89f27bb86c9d444c40f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1afd40321f1c243cffbcf40ea7ca41aca87fa5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcdd2242c0231032fc84e1404315c245ae56322a"
        }
      ],
      "title": "vsock: Keep the binding until socket destruction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21756",
    "datePublished": "2025-02-27T02:18:11.547Z",
    "dateReserved": "2024-12-29T08:45:45.760Z",
    "dateUpdated": "2026-08-05T11:54:09.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:8056

CVE-2024-40906 (GCVE-0-2024-40906)

CVE-2024-44970 (GCVE-0-2024-44970)

CVE-2025-21756 (GCVE-0-2025-21756)

Tags

Sightings

Nomenclature

Related by attack behaviour