Vulnerability-Lookup

RHSA-2026:68570

Vulnerability from csaf_opensuse - Published: 2026-09-17 14:39 - Updated: 2026-09-24 09:39

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298) * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) Bug Fix(es) and Enhancement(s): * gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:RHEL-252540) * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:RHEL-252544) * gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:RHEL-253986) * [RHEL9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255217) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:RHEL-256733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-23172

A flaw was found in the Linux kernel's t7xx WWAN driver. A malicious, buggy, or compromised modem firmware can exploit this by sending packets with excessive fragments. This leads to a buffer overflow in the `skb_shinfo(skb)->frags[]` array, corrupting adjacent memory. This can result in kernel crashes or other undefined behavior, effectively causing a Denial of Service (DoS).

7.4 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 303 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-687.49.1.el9_8.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rtla-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rv-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.49.1.el9_8.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-687.49.1.el9_8.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-uki-virt-addons-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-64k-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.49.1.el9_8.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-31663

A flaw was found in the Linux kernel's `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-826 - Premature Release of Resource During Expected Lifetime

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-45910

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) RXE component. A race condition exists between the `retransmit_timer()` and `rxe_destroy_qp` functions. This can cause a Queue Pair (QP) reference count to underflow, leading to a use-after-free vulnerability. A local attacker could potentially leverage this to cause a denial of service or achieve arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-46043

A flaw was found in the Linux kernel's RDMA/rxe component. The `rxe_rcv()` function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forged BTH pad. This could lead to an integer underflow, potentially causing unexpected behavior or a denial of service in the receive path.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-191 - Integer Underflow (Wrap or Wraparound)

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-46114

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMIC_WRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMIC_WRITE payloads allows the attacker to read past the intended packet boundary. Consequently, sensitive kernel memory, such as kernel strings and partial kernel-direct-map pointer words, can be disclosed into the attacker's memory region.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-46133

A flaw was found in the Linux kernel's Soft RoCE (RDMA/rxe) driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service (DoS) on the affected system. The issue arises from insufficient validation of unknown opcodes before performing length arithmetic during Cyclic Redundancy Check (CRC) processing.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-191 - Integer Underflow (Wrap or Wraparound)

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-52971

A flaw was found in the Linux kernel's Elastic Network Adapter (ENA) driver, specifically within the Precision Time Protocol Hardware Clock (PHC) timestamp retrieval function. A race condition exists where the `get_timestamp` function could attempt to access memory that has already been freed by the `ena_com_phc_destroy` function. This use-after-free vulnerability can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-53176

A flaw was found in the Linux kernel's Internet Small Computer System Interface (iSCSI) Extensions for Remote Direct Memory Access (RDMA) (iSER) module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow causes a negative length to be used in a memory copy operation, resulting in an out-of-bounds write that crashes the system. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-839 - Numeric Range Comparison Without Minimum Check

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-53192

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A race condition can occur during the release of a timer object, specifically when the SNDRV_TIMER_IOCTL_PARAMS ioctl is called concurrently. This can lead to a use-after-free vulnerability, potentially allowing a local attacker to achieve arbitrary code execution or cause a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-53193

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. This vulnerability occurs when a timer object is freed while timer instances are still associated with it, particularly when userspace-driven timers are involved. A local user can exploit this by repeatedly creating and deleting timer objects, leading to a use-after-free condition. This can result in system instability or denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-53196

A flaw was found in the Linux kernel's `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device's I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service).

6.8 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-53239

A flaw was found in the Linux kernel. A race condition exists in the `xfrm` policy handling, specifically within the `xfrm_policy_bysel_ctx()` function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial of service (DoS), making the system unresponsive or causing it to crash.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-63869

A flaw was found in the Linux kernel's mac80211 WiFi subsystem. This vulnerability allows an attacker to cause undefined behavior by injecting a specially crafted frame with an invalid radiotap header. This can lead to system instability or a denial of service (DoS), potentially causing the system to crash.

7.6 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CWE-1335 - Incorrect Bitwise Shift of Integer

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-63913

A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP (Transmission Control Protocol) packets, specifically a SYN (synchronize) packet followed by an RST (reset) packet with an invalid sequence number. This improper handling of the RST packet can prematurely terminate an active Network Address Translation (NAT) entry, making connection teardown easier than intended and potentially leading to a denial of service for affected connections.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-63917

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kernel bug, resulting in a denial of service (system crash) and potentially impacting container isolation on affected hosts.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-63919

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespace during this deferred operation could lead to a use-after-free vulnerability. This could allow an attacker to potentially cause a system crash or other unpredictable behavior if the network namespace is deallocated prematurely.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-63921

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect network traffic intended for other parts of the system or other containers, leading to unauthorized information disclosure or denial of service across different tenants on a container host.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-653 - Improper Isolation or Compartmentalization

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-64029

A flaw was found in the Advanced Linux Sound Architecture (ALSA) sequencer component of the Linux kernel. This vulnerability, a use-after-free, occurs because of improper synchronization when handling Universal MIDI Packet (UMP) output. A local attacker could exploit this by creating a specific timing issue, which may lead to a system crash, resulting in a denial of service, or potentially allow for increased privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-64174

A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. A remote attacker, by sending a specially-crafted malicious Wi-Fi beacon, could exploit a vulnerability in the cfg80211_merge_profile() function. This flaw causes the kernel to spend an excessive amount of processing time, leading to a Denial of Service (DoS) condition. This could theoretically be abused to impact system availability.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-64175

A flaw was found in the Linux kernel's iwlwifi driver. When the Wi-Fi firmware crashes, the driver continues to process network transmission requests inefficiently. This creates a continuous loop of attempting to send data through an unresponsive firmware, consuming excessive CPU resources and memory. This can lead to resource exhaustion and a denial of service (DoS) for the system.

7.3 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-64176

A flaw was found in the Linux kernel's iwlwifi driver, affecting older Intel wireless devices. This vulnerability arises from incorrect handling of transmit (TX) rates, specifically when the driver attempts to set these rates. An attacker could potentially trigger a firmware assert or crash, leading to a denial of service (DoS) for the affected wireless functionality.

7.3 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-64582

A flaw was found in the Linux kernel's RDMA/rxe component. A race condition in the `rxe_mmap()` function, which manages memory for Remote Direct Memory Access (RDMA) operations, can lead to a use-after-free vulnerability. A local attacker could exploit this timing issue to cause a system crash, resulting in a denial of service. In some scenarios, this could also potentially lead to a page-level use-after-free, which might allow for further system compromise.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-68128

A flaw was found in the Linux kernel's ice driver. A malicious virtual function (VF) can provide an out-of-range 'ptype' value through the VIRTCHNL interface. This can lead to a write past the end of an allocated memory region, causing a kernel page fault and resulting in a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-68159

A flaw was found in libceph in the Linux kernel. A remote attacker, acting as a malicious monitor, could send a specially crafted OSDMap (Object Storage Device Map) with an overly long pg_temp or pg_upmap entry. This could lead to a stack out-of-bounds write, resulting in a kernel bug and potentially a denial of service.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-68200

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A lack of serialization in the userspace-driven timer (utimer) TRIGGER ioctl allows two threads to concurrently call snd_timer_interrupt(). This race condition can lead to a use-after-free vulnerability, where a timer instance is freed while its callback is still running. A local attacker with the ability to open /dev/snd/timer could exploit this to achieve privilege escalation.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-68363

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger a use-after-free vulnerability. This could lead to reading freed memory, potentially causing a system crash and resulting in a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-68426

A flaw was found in the Linux kernel's `xfrm` subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition to cause a system crash (denial of service) or, in some scenarios, execute unauthorized code.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-72003

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE (Simultaneous Authentication of Equals) authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary code execution or a denial of service (DoS) on the affected system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-72102

A flaw was found in the Linux kernel's device mapper (DM) subsystem. During certain resume operations, the kernel might attempt to free a memory table that has already been released. This error, known as a double-free vulnerability, can lead to memory corruption. A successful exploit could result in a system crash, causing a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Moderate

CVE-2026-72243

A flaw was found in the Linux kernel's Security-Enhanced Linux (SELinux) module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network connections that should have been restricted by security policies.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

CVE-2026-72298

A flaw was found in the Linux kernel's `qrtr` network component. On 32-bit systems, a 32-bit integer overflow can occur in the `qrtr_endpoint_post()` function when processing an incoming packet. This overflow can bypass a size validation check, leading to an out-of-bounds write and causing the kernel to crash. This vulnerability could allow a local attacker to cause a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 303 products, the same list as for CVE-2026-23172

Threats

Impact Important

References

190 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68570	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2439924	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461462	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482098	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482127	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482550	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482618	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492436	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492741	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492742	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492779	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492792	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502295	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502347	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502368	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502412	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502434	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502438	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502575	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502580	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502596	external
https://bugzilla.redhat.com/show_bug.cgi?id=2511448	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513165	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513171	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513271	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513286	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513477	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516490	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516599	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516679	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516684	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-23172	self
https://bugzilla.redhat.com/show_bug.cgi?id=2439924	external
https://www.cve.org/CVERecord?id=CVE-2026-23172	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23172	external
https://lore.kernel.org/linux-cve-announce/202602…	external
https://access.redhat.com/security/cve/CVE-2026-31663	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461462	external
https://www.cve.org/CVERecord?id=CVE-2026-31663	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31663	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-45910	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482098	external
https://www.cve.org/CVERecord?id=CVE-2026-45910	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45910	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46043	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482127	external
https://www.cve.org/CVERecord?id=CVE-2026-46043	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46043	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46114	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482618	external
https://www.cve.org/CVERecord?id=CVE-2026-46114	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46114	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46133	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482550	external
https://www.cve.org/CVERecord?id=CVE-2026-46133	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46133	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-52971	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492436	external
https://www.cve.org/CVERecord?id=CVE-2026-52971	external
https://nvd.nist.gov/vuln/detail/CVE-2026-52971	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53176	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492741	external
https://www.cve.org/CVERecord?id=CVE-2026-53176	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53176	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53192	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492792	external
https://www.cve.org/CVERecord?id=CVE-2026-53192	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53192	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53193	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492742	external
https://www.cve.org/CVERecord?id=CVE-2026-53193	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53193	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53196	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	external
https://www.cve.org/CVERecord?id=CVE-2026-53196	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53196	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-53239	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492779	external
https://www.cve.org/CVERecord?id=CVE-2026-53239	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53239	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-63869	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502295	external
https://www.cve.org/CVERecord?id=CVE-2026-63869	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63869	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63913	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502438	external
https://www.cve.org/CVERecord?id=CVE-2026-63913	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63913	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63917	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502434	external
https://www.cve.org/CVERecord?id=CVE-2026-63917	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63917	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63919	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502412	external
https://www.cve.org/CVERecord?id=CVE-2026-63919	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63919	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63921	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502368	external
https://www.cve.org/CVERecord?id=CVE-2026-63921	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63921	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64029	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502347	external
https://www.cve.org/CVERecord?id=CVE-2026-64029	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64029	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64174	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502580	external
https://www.cve.org/CVERecord?id=CVE-2026-64174	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64174	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64175	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502596	external
https://www.cve.org/CVERecord?id=CVE-2026-64175	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64175	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64176	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502575	external
https://www.cve.org/CVERecord?id=CVE-2026-64176	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64176	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64582	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511448	external
https://www.cve.org/CVERecord?id=CVE-2026-64582	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64582	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68128	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513271	external
https://www.cve.org/CVERecord?id=CVE-2026-68128	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68128	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68159	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513165	external
https://www.cve.org/CVERecord?id=CVE-2026-68159	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68159	external
https://git.kernel.org/stable/c/9f00f9cf2be293efe…	external
https://git.kernel.org/stable/c/e36663145abd7024f…	external
https://access.redhat.com/security/cve/CVE-2026-68200	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513171	external
https://www.cve.org/CVERecord?id=CVE-2026-68200	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68200	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68363	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513286	external
https://www.cve.org/CVERecord?id=CVE-2026-68363	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68363	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68426	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513477	external
https://www.cve.org/CVERecord?id=CVE-2026-68426	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68426	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72003	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516679	external
https://www.cve.org/CVERecord?id=CVE-2026-72003	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72003	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72102	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516490	external
https://www.cve.org/CVERecord?id=CVE-2026-72102	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72102	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72243	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516684	external
https://www.cve.org/CVERecord?id=CVE-2026-72243	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72243	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72298	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516599	external
https://www.cve.org/CVERecord?id=CVE-2026-72298	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72298	external
https://lore.kernel.org/linux-cve-announce/202608…	external

JSON

To clipboard

Loading 3.1 MB of JSON…

CVE-2026-53196 (GCVE-0-2026-53196)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-18 12:04

Title

USB: serial: io_ti: fix heap overflow in get_manuf_info()

Summary

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes. The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver. valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access. Fix by rejecting descriptors with unexpected length before calling read_rom(). [ johan: amend commit message; also check for short descriptors ]

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux mitre root

References

21 references

URL	Tags
https://git.kernel.org/stable/c/e168db91442b94e64…
https://git.kernel.org/stable/c/561edb021486e6723…
https://git.kernel.org/stable/c/cfd634f6dfd40c49a…
https://git.kernel.org/stable/c/d92f17af7097d10bd…
https://git.kernel.org/stable/c/b849f30d1a9e66aae…
https://git.kernel.org/stable/c/f96cf7bf9fbf15d7f…
https://git.kernel.org/stable/c/d214d2341d4f9f447…
https://git.kernel.org/stable/c/183c1076eca43bbb3…
https://access.redhat.com/security/cve/CVE-2026-53196	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:67114	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61887	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67723	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65708	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65710	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65711	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65709	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67721	vendor-advisoryx_refsource_REDHAT

Impacted products

19 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e168db91442b94e64fa82a7dd297983d48ea5cc0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 561edb021486e6723d841926aa4b48097da06190 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cfd634f6dfd40c49a84f9bddc2867a80e2e2623a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d92f17af7097d10bdeddf26f66f34b354104b277 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b849f30d1a9e66aae6b715aaef66e427390cb081 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d214d2341d4f9f447e36a7d012cdf6a6631a55f1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 183c1076eca43bbb3e7bdf597456f91d81c73e74 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.50.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.104.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.206.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.206.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.213.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.213.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.166.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.166.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.49.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.191.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.191.1.rt14.476.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.149.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.140.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.104.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.206.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.206.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.213.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.213.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.166.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.166.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.49.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.191.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.191.1.rt14.476.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.149.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.140.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device\u0027s I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T12:04:49.281Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53196"
          },
          {
            "name": "RHBZ#2492750",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53196.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67114"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65708"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65710"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65711"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65709"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67721"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:67114: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67723: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68570: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65710: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65711: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65709: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67721: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/io_ti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e168db91442b94e64fa82a7dd297983d48ea5cc0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "561edb021486e6723d841926aa4b48097da06190",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cfd634f6dfd40c49a84f9bddc2867a80e2e2623a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d92f17af7097d10bdeddf26f66f34b354104b277",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b849f30d1a9e66aae6b715aaef66e427390cb081",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d214d2341d4f9f447e36a7d012cdf6a6631a55f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "183c1076eca43bbb3e7bdf597456f91d81c73e74",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/io_ti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in get_manuf_info()\n\nget_manuf_info() reads le16_to_cpu(rom_desc-\u003eSize) bytes from the\ndevice I2C EEPROM into a buffer allocated with kmalloc_obj(), which\nis sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.\n\nThe Size field comes from the device and is only validated (in\ncheck_i2c_image()) to make sure the descriptor fits within\nTI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.\nA malicious USB device can therefore set Size to any value up to 16377,\ncausing a heap overflow of up to 16367 bytes when plugged into a host\nrunning this driver.\n\nvalid_csum() is called after read_rom() and also iterates\nbuffer[0..Size-1], compounding the out-of-bounds access.\n\nFix by rejecting descriptors with unexpected length before calling\nread_rom().\n\n[ johan: amend commit message; also check for short descriptors ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:39:06.330Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277"
        },
        {
          "url": "https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081"
        },
        {
          "url": "https://git.kernel.org/stable/c/f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74"
        }
      ],
      "title": "USB: serial: io_ti: fix heap overflow in get_manuf_info()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53196",
    "datePublished": "2026-06-25T08:39:06.330Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-09-18T12:04:49.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53239 (GCVE-0-2026-53239)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50

Title

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed. Race: CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO) ========================== ========================== xfrm_policy_bysel_ctx(): spin_lock_bh(xfrm_policy_lock) bin = xfrm_policy_inexact_lookup() __xfrm_policy_unlink(pol) spin_unlock_bh(xfrm_policy_lock) xfrm_policy_kill(ret) // wide window, lock not held xfrm_hash_rebuild(): spin_lock_bh(xfrm_policy_lock) __xfrm_policy_inexact_flush(): kfree_rcu(bin) // bin freed spin_unlock_bh(xfrm_policy_lock) xfrm_policy_inexact_prune_bin(bin) // UAF: bin is freed

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/8fc536e9f6856230f…
https://git.kernel.org/stable/c/c4c1ea36d83bf3c45…
https://git.kernel.org/stable/c/25c8c7fb3b0b9668c…
https://git.kernel.org/stable/c/42827d03f8009a6a2…
https://git.kernel.org/stable/c/88697cf980222d590…
https://git.kernel.org/stable/c/b5316e2b8614a87d8…
https://git.kernel.org/stable/c/ec82ea4eb220164d8…
https://git.kernel.org/stable/c/7f2d76c9c03257c07…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 8fc536e9f6856230f19c7d13e71af064b6a77b22 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < c4c1ea36d83bf3c4569468ca5b8b614fda1bf821 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 25c8c7fb3b0b9668c7d05e209f58c158d2b020c7 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 42827d03f8009a6a218bacab153e21f39d6a121c (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 88697cf980222d5906a37bf47662dac0732e2a0f (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < b5316e2b8614a87d8736941972441cb47bfd4491 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < ec82ea4eb220164d854f8734ca5a35e23e577b94 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 7f2d76c9c03257c0782afef9d95321fa04096f60 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:50:08.903Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fc536e9f6856230f19c7d13e71af064b6a77b22",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "c4c1ea36d83bf3c4569468ca5b8b614fda1bf821",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "25c8c7fb3b0b9668c7d05e209f58c158d2b020c7",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "42827d03f8009a6a218bacab153e21f39d6a121c",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "88697cf980222d5906a37bf47662dac0732e2a0f",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "b5316e2b8614a87d8736941972441cb47bfd4491",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "ec82ea4eb220164d854f8734ca5a35e23e577b94",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            },
            {
              "lessThan": "7f2d76c9c03257c0782afef9d95321fa04096f60",
              "status": "affected",
              "version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n  CPU0 (XFRM_MSG_DELPOLICY)           CPU1 (XFRM_MSG_NEWSPDINFO)\n  ==========================          ==========================\n  xfrm_policy_bysel_ctx():\n    spin_lock_bh(xfrm_policy_lock)\n    bin = xfrm_policy_inexact_lookup()\n    __xfrm_policy_unlink(pol)\n    spin_unlock_bh(xfrm_policy_lock)\n    xfrm_policy_kill(ret)\n    // wide window, lock not held\n                                       xfrm_hash_rebuild():\n                                         spin_lock_bh(xfrm_policy_lock)\n                                         __xfrm_policy_inexact_flush():\n                                           kfree_rcu(bin)  // bin freed\n                                         spin_unlock_bh(xfrm_policy_lock)\n    xfrm_policy_inexact_prune_bin(bin)\n    // UAF: bin is freed"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through NETLINK_XFRM messages such as XFRM_MSG_DELPOLICY and XFRM_MSG_NEWSPDINFO, which require local netlink access rather than remote packet delivery.\nAC:L - The attacker controls both sides of the race by creating/deleting an inexact XFRM policy while concurrently triggering SPD hash rebuilds, with no required external victim state.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN, but the check is namespace-scoped via netlink_net_capable() and is reachable with CAP_NET_ADMIN in a user-created network namespace on systems allowing user namespaces.\nUI:N - No victim action is required; the attacker can issue the needed netlink messages directly.\nS:U - The vulnerability corrupts kernel networking/XFRM state within the same kernel security authority and does not cross a hypervisor, IOMMU, or separate trust boundary.\nC:H - This is a use-after-free of an XFRM inexact policy bin, and the stale freed object can be dereferenced after attacker-controlled heap reuse, making high confidentiality impact defensible.\nI:H - The stale bin is not only read but also passed into pruning logic that writes list/rhashtable/seqcount state, so exploitation can plausibly yield memory corruption and control-flow or data integrity compromise.\nA:H - The UAF can trigger kernel memory corruption, KASAN splats, oopses, or panics, giving high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:25.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"
        },
        {
          "url": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c"
        },
        {
          "url": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60"
        }
      ],
      "title": "xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53239",
    "datePublished": "2026-06-25T08:39:35.149Z",
    "dateReserved": "2026-06-09T07:44:35.393Z",
    "dateUpdated": "2026-09-08T08:50:08.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63869 (GCVE-0-2026-63869)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:18 – Updated: 2026-08-05 12:36

Title

wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directly as a shift count: info->control.antennas |= BIT(*iterator.this_arg); *iterator.this_arg is an 8-bit value taken straight from the frame supplied by userspace, so BIT() can be asked to shift by up to 255. That is undefined behaviour on the unsigned long and is reported by UBSAN: UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30 shift exponent 235 is too large for 64-bit type 'unsigned long' Call Trace: ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174 ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451 ... packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109 info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 can ever be represented. Ignore any larger value instead of shifting out of bounds.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/f6d3dc8e8492bf843…
https://git.kernel.org/stable/c/9b40c59bab08f2a99…
https://git.kernel.org/stable/c/033ce021a220913ac…
https://git.kernel.org/stable/c/6c0cf89f36ac0c0fd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < f6d3dc8e8492bf8435e0b23c99472af7bafd6b44 (git) Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < 9b40c59bab08f2a99abf969cc0bb92fa49de004b (git) Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < 033ce021a220913ac02416fcb5ac883a9ff8b6c7 (git) Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < 6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663 (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6d3dc8e8492bf8435e0b23c99472af7bafd6b44",
              "status": "affected",
              "version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
              "versionType": "git"
            },
            {
              "lessThan": "9b40c59bab08f2a99abf969cc0bb92fa49de004b",
              "status": "affected",
              "version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
              "versionType": "git"
            },
            {
              "lessThan": "033ce021a220913ac02416fcb5ac883a9ff8b6c7",
              "status": "affected",
              "version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
              "versionType": "git"
            },
            {
              "lessThan": "6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663",
              "status": "affected",
              "version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap\n\nWhen parsing the radiotap header of an injected frame,\nieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value\ndirectly as a shift count:\n\n\tinfo-\u003econtrol.antennas |= BIT(*iterator.this_arg);\n\n*iterator.this_arg is an 8-bit value taken straight from the frame\nsupplied by userspace, so BIT() can be asked to shift by up to 255. That\nis undefined behaviour on the unsigned long and is reported by UBSAN:\n\n  UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30\n  shift exponent 235 is too large for 64-bit type \u0027unsigned long\u0027\n  Call Trace:\n   ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174\n   ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451\n   ...\n   packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109\n\ninfo-\u003econtrol.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna\nindices 0 and 1 can ever be represented. Ignore any larger value instead\nof shifting out of bounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in mac80211 WiFi frame injection (radiotap parsing on monitor-mode TX), reachable only on systems with WiFi hardware in monitor mode; per kernel CNA guidance, WiFi frame injection maps to Adjacent.\nAC:L - The attacker fully controls the injected radiotap header via sendmsg() on an AF_PACKET socket and can reliably set IEEE80211_RADIOTAP_ANTENNA to any 8-bit value to trigger the out-of-bounds shift.\nPR:L - Reaching the path requires CAP_NET_RAW to open AF_PACKET sockets and CAP_NET_ADMIN to create a monitor interface via nl80211; both capabilities are obtainable by an unprivileged user through user namespaces (unshare -Urn).\nUI:N - Exploitation requires no action from a victim user; the attacker injects crafted frames through their own local socket.\nS:U - Impact is confined to kernel memory and WiFi TX state within the same security authority; this is not a VM escape or cross-boundary sandbox breakout.\nC:H - The unchecked antenna index causes shift-out-of-bounds undefined behavior while parsing attacker-controlled data into the skb control block (ieee80211_tx_info), constituting kernel memory corruption that could be leveraged for information disclosure.\nI:H - The undefined-behavior shift result is ORed into a bitfield in skb-\u003ecb, corrupting injection control metadata in kernel memory; such corruption in the TX path is potentially exploitable for further memory writes or control-flow manipulation.\nA:L - The primary demonstrated impact is a UBSAN shift-out-of-bounds report rather than a demonstrated kernel panic, but undefined behavior during packet processing can still cause degraded or unpredictable system behavior."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:44.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6d3dc8e8492bf8435e0b23c99472af7bafd6b44"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b40c59bab08f2a99abf969cc0bb92fa49de004b"
        },
        {
          "url": "https://git.kernel.org/stable/c/033ce021a220913ac02416fcb5ac883a9ff8b6c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663"
        }
      ],
      "title": "wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63869",
    "datePublished": "2026-07-19T14:18:38.426Z",
    "dateReserved": "2026-07-19T07:54:57.017Z",
    "dateUpdated": "2026-08-05T12:36:44.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63913 (GCVE-0-2026-63913)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/2006979a15af5404b…
https://git.kernel.org/stable/c/6476c17d536dbd321…
https://git.kernel.org/stable/c/f5547bebc416d56f5…
https://git.kernel.org/stable/c/2bb6d82b586ea5a4c…
https://git.kernel.org/stable/c/f206def4e86d810f9…
https://git.kernel.org/stable/c/b98ab51c45c5608a1…
https://git.kernel.org/stable/c/d67c6adee8d1b6533…
https://git.kernel.org/stable/c/bed6e04be8e6b9133…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 2006979a15af5404bf932a325357683c0bac1656 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 6476c17d536dbd321c073242e762ddb2713a1238 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < f5547bebc416d56f56fb5b86dc20aabfa42165a0 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < f206def4e86d810f927ba1d8e322ea72b29bce58 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < b98ab51c45c5608a1c19ce7fd17a3032469bb83f (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < d67c6adee8d1b65330d0174c4c367faba14e80a8 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a (git)
Linux	Linux	Affected: 2.6.15 Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2006979a15af5404bf932a325357683c0bac1656",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "6476c17d536dbd321c073242e762ddb2713a1238",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.\nAC:L - The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.\nPR:N - Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.\nUI:N - No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.\nS:U - Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.\nC:N - This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.\nI:L - The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.\nA:H - Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:07.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"
        },
        {
          "url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"
        },
        {
          "url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"
        }
      ],
      "title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63913",
    "datePublished": "2026-07-19T14:55:17.917Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:07.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63917 (GCVE-0-2026-63917)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

ip6: vti: Use ip6_tnl.net in vti6_changelink().

Summary

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/0cdce7618464f7fb0…
https://git.kernel.org/stable/c/f5c68875e25f331e4…
https://git.kernel.org/stable/c/d9c5eecdb3c740e65…
https://git.kernel.org/stable/c/f1e89a943ee574d0f…
https://git.kernel.org/stable/c/225b467e3b631f38b…
https://git.kernel.org/stable/c/fc32be9ac2788524c…
https://git.kernel.org/stable/c/ee1778ba0f5cb53be…
https://git.kernel.org/stable/c/11b326fb0a374f465…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 0cdce7618464f7fb06f461e8f4ad575cb1d570f4 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < f5c68875e25f331e497ddfbe81e2d8163a87f136 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < d9c5eecdb3c740e65038651db7c686b10d76d1bc (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < f1e89a943ee574d0f2f16246eb3f2d7330fdeb03 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 225b467e3b631f38be22e4b38062a1fed02fdd21 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < fc32be9ac2788524c6b24efd681cce7a6e731a92 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < ee1778ba0f5cb53be771f97017d01eb356c797bf (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe (git)
Linux	Linux	Affected: 3.15 Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_vti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cdce7618464f7fb06f461e8f4ad575cb1d570f4",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "f5c68875e25f331e497ddfbe81e2d8163a87f136",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "d9c5eecdb3c740e65038651db7c686b10d76d1bc",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "f1e89a943ee574d0f2f16246eb3f2d7330fdeb03",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "225b467e3b631f38be22e4b38062a1fed02fdd21",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "fc32be9ac2788524c6b24efd681cce7a6e731a92",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "ee1778ba0f5cb53be771f97017d01eb356c797bf",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_vti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[  132.495484] ------------[ cut here ]------------\n[  132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t-\u003enet stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t-\u003edev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker\u0027s security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:11.588Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03"
        },
        {
          "url": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe"
        }
      ],
      "title": "ip6: vti: Use ip6_tnl.net in vti6_changelink().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63917",
    "datePublished": "2026-07-19T14:55:20.703Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:11.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63919 (GCVE-0-2026-63919)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

xfrm: input: hold netns during deferred transport reinjection

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down. This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net().

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7ee59eda8820b758e…
https://git.kernel.org/stable/c/2df7059a18afb7d3a…
https://git.kernel.org/stable/c/8dfabcba6a943a7a0…
https://git.kernel.org/stable/c/48ce101cd630d6745…
https://git.kernel.org/stable/c/55ddfc41451f01c58…
https://git.kernel.org/stable/c/9f7ebb45a83afc321…
https://git.kernel.org/stable/c/9f67a36e91bb50d35…
https://git.kernel.org/stable/c/c16f74dc1d75d0e2e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 7ee59eda8820b758ed29e1cd3222359c7b97302c (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 2df7059a18afb7d3aee6c36cad5d371c198111d4 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 8dfabcba6a943a7a02ebe1e1637c361ba96acbaa (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 48ce101cd630d6745b6923b5bad8358bc4c119da (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 55ddfc41451f01c588089cd74957a05311b6f202 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 9f7ebb45a83afc3216e855e57d51bb4bc9b5232e (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 9f67a36e91bb50d358760f381f233913fe5c09f8 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < c16f74dc1d75d0e2e7670076d5375deda110ebeb (git)
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ee59eda8820b758ed29e1cd3222359c7b97302c",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "2df7059a18afb7d3aee6c36cad5d371c198111d4",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "8dfabcba6a943a7a02ebe1e1637c361ba96acbaa",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "48ce101cd630d6745b6923b5bad8358bc4c119da",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "55ddfc41451f01c588089cd74957a05311b6f202",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "9f7ebb45a83afc3216e855e57d51bb4bc9b5232e",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "9f67a36e91bb50d358760f381f233913fe5c09f8",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "c16f74dc1d75d0e2e7670076d5375deda110ebeb",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: input: hold netns during deferred transport reinjection\n\nTransport-mode reinjection stores a struct net pointer in skb-\u003ecb and\nuses it later from xfrm_trans_reinject(). That pointer must stay valid\nuntil the deferred callback runs.\n\nTake a netns reference when queueing deferred reinjection work and drop\nit after the callback completes. Use maybe_get_net() so the queueing\npath does not revive a namespace that is already being torn down.\n\nThis keeps the existing workqueue design and fixes the netns lifetime\nhandling in one place for all users of xfrm_trans_queue_net()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:13.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da"
        },
        {
          "url": "https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb"
        }
      ],
      "title": "xfrm: input: hold netns during deferred transport reinjection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63919",
    "datePublished": "2026-07-19T14:55:22.121Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:13.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63921 (GCVE-0-2026-63921)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

Summary

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns */ t = vti6_locate(net, &p1, false) /* misses target in t->net */ ... t = netdev_priv(dev) vti6_update(t, &p1, false) /* mutates t->net's hash */ A caller in the migrated netns picks params that match a tunnel in the creation netns. The lookup in dev_net(dev) finds nothing. vti6_update() prepends the migrated tunnel at the head of the creation netns hash bucket for those params. Later lookups in the creation netns resolve to the migrated device. xfrm receive delivers the matched packets through a device the caller controls. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Switch the SIOCCHGTUNNEL path on a non fallback device to use t->net for the lookup. The lookup now matches the netns vti6_update() operates on. Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before the lookup. The check at the top of the case is against dev_net(dev)->user_ns, which after migration is the attacker's netns. A caller there can pick params absent from self->net, the lookup returns NULL, t becomes self, and vti6_update() inserts the device into the creation netns hash. The new check requires CAP_NET_ADMIN in the creation netns user_ns too. SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep dev_net(dev), which equals init_net there.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/94ff740a7f9ef5c01…
https://git.kernel.org/stable/c/df42ac708acc3399b…
https://git.kernel.org/stable/c/44d2ff7d2178503b9…
https://git.kernel.org/stable/c/1acfb7d9c6fc7e209…
https://git.kernel.org/stable/c/d2236348414bdd655…
https://git.kernel.org/stable/c/853f6ea482dfcd340…
https://git.kernel.org/stable/c/596f6354c96a891e5…
https://git.kernel.org/stable/c/8b484efd5cb4eeef9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 94ff740a7f9ef5c010784a325dca00cbf228f941 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < df42ac708acc3399bbb6dc5ca16e0540adda7bbf (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 44d2ff7d2178503b93151140a45dfa2ad49c9906 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 1acfb7d9c6fc7e209ed7789392697e97e03edd33 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < d2236348414bdd6558385f35aa7fdc9bf5634011 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 853f6ea482dfcd3404bbef458ab4d68364eed838 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 596f6354c96a891e58c04a09cbfb7b0d1ec00dab (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 8b484efd5cb4eeef9021a661e198edc5349dacf6 (git)
Linux	Linux	Affected: 3.15 Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_vti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94ff740a7f9ef5c010784a325dca00cbf228f941",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "df42ac708acc3399bbb6dc5ca16e0540adda7bbf",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "44d2ff7d2178503b93151140a45dfa2ad49c9906",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "1acfb7d9c6fc7e209ed7789392697e97e03edd33",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "d2236348414bdd6558385f35aa7fdc9bf5634011",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "853f6ea482dfcd3404bbef458ab4d68364eed838",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "596f6354c96a891e58c04a09cbfb7b0d1ec00dab",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            },
            {
              "lessThan": "8b484efd5cb4eeef9021a661e198edc5349dacf6",
              "status": "affected",
              "version": "61220ab349485d911083d0b7990ccd3db6c63297",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_vti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t-\u003enet. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t-\u003enet.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n  net = dev_net(dev)                    /* migrated netns */\n  t   = vti6_locate(net, \u0026p1, false)    /* misses target in t-\u003enet */\n  ...\n  t   = netdev_priv(dev)\n  vti6_update(t, \u0026p1, false)            /* mutates t-\u003enet\u0027s hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt-\u003enet for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self-\u003enet-\u003euser_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)-\u003euser_ns, which after migration is the attacker\u0027s\nnetns. A caller there can pick params absent from self-\u003enet,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace\u0027s user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant\u0027s network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker\u0027s own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant\u0027s network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim\u0027s IPsec connectivity."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:15.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941"
        },
        {
          "url": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906"
        },
        {
          "url": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011"
        },
        {
          "url": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838"
        },
        {
          "url": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6"
        }
      ],
      "title": "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63921",
    "datePublished": "2026-07-19T14:55:23.539Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:15.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64029 (GCVE-0-2026-64029)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38

Title

ALSA: seq: Serialize UMP output teardown with event_input

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() and seq_ump_client_close(). The last output unuse can therefore drop opened[STR_OUT] to zero and release the rawmidi file while an in-flight event_input callback is still inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream runtime exposed to teardown before the write path has taken its own buffer reference. Add a per-client rwlock for the event_input-visible output file. Publish a newly opened output file under the write side, and hold the read side from the output lookup through snd_rawmidi_kernel_write(). The last output close copies and clears the visible output file under the write side, then drops the lock and releases the saved rawmidi file. Use IRQ-safe rwlock guards because event_input can also be reached from atomic sequencer delivery. The buggy scenario involves two paths, with each column showing the order within that path: path A label: event_input path path B label: last unuse path 1. seq_ump_process_event() reads 1. seq_ump_client_close() client->out_rfile.output. drops opened[STR_OUT] to zero. 2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release() has not yet pinned runtime. closes the output file. 3. The writer continues using 3. close_substream() frees the borrowed substream. substream->runtime. This keeps the output substream and runtime alive for the full event_input write while keeping rawmidi release outside the rwlock. KASAN reproduced this as a slab-use-after-free in snd_rawmidi_kernel_write1(), with allocation through seq_ump_use()/snd_seq_port_connect() and free through seq_ump_unuse()/snd_seq_port_disconnect(). Validation reproduced this kernel report: KASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400 RIP: 0033:0x7f5528af837f Read of size 8 Call trace: dump_stack_lvl+0x73/0xb0 (?:?) print_report+0xd1/0x650 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x1a7/0x340 (?:?) kasan_complete_mode_report_info+0x64/0x200 (?:?) kasan_report+0xf7/0x130 (?:?) snd_rawmidi_kernel_write1+0x9d/0x400 (?:?) __asan_load8+0x82/0xb0 (?:?) update_stack_state+0x1ef/0x2d0 (?:?) snd_rawmidi_kernel_write+0x1a/0x20 (?:?) seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82) __snd_seq_deliver_single_event+0x8a/0xe0 (?:?) snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?) lock_acquire+0x14e/0x2e0 (?:?) find_held_lock+0x31/0x90 (?:?) snd_seq_port_use_ptr+0xa6/0xe0 (?:?) __kasan_check_write+0x18/0x20 (?:?) do_raw_read_unlock+0x32/0xa0 (?:?) _raw_read_unlock+0x26/0x50 (?:?) snd_seq_deliver_single_event+0x45c/0x4b0 (?:?) snd_seq_deliver_event+0x10d/0x1b0 (?:?) snd_seq_client_enqueue_event+0x192/0x240 (?:?) snd_seq_write+0x2cd/0x450 (?:?) apparmor_file_permission+0x20/0x30 (?:?) security_file_permission+0x51/0x60 (?:?) vfs_write+0x1ce/0x850 (?:?) __fget_files+0x12b/0x220 (?:?) lock_release+0xc8/0x2a0 (?:?) __rcu_read_unlock+0x74/0x2d0 (?:?) __fget_files+0x135/0x220 (?:?) ksys_write+0x15a/0x180 (?:?) rcu_is_watching+0x24/0x60 (?:?) __x64_sys_write+0x46/0x60 (?:?) x64_sys_call+0x7d/0x20d0 (?:?) do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/8ba1c4ddbb1c67d34…
https://git.kernel.org/stable/c/0cb1ad79557016755…
https://git.kernel.org/stable/c/3aab4a58d23fb22da…
https://git.kernel.org/stable/c/ef46b616a4c219185…
https://git.kernel.org/stable/c/60a1969fae6209644…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 0cb1ad795570167558530d6194297ac2396a1991 (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < ef46b616a4c219185bbf10ebcbacb571583fd0e4 (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 60a1969fae6209644698fca91c185d153674f631 (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_ump_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb",
              "status": "affected",
              "version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
              "versionType": "git"
            },
            {
              "lessThan": "0cb1ad795570167558530d6194297ac2396a1991",
              "status": "affected",
              "version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
              "versionType": "git"
            },
            {
              "lessThan": "3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b",
              "status": "affected",
              "version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
              "versionType": "git"
            },
            {
              "lessThan": "ef46b616a4c219185bbf10ebcbacb571583fd0e4",
              "status": "affected",
              "version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
              "versionType": "git"
            },
            {
              "lessThan": "60a1969fae6209644698fca91c185d153674f631",
              "status": "affected",
              "version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_ump_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Serialize UMP output teardown with event_input\n\nseq_ump_process_event() borrows client-\u003eout_rfile.output without\nsynchronizing with the first-open and last-close transition in\nseq_ump_client_open() and seq_ump_client_close().\n\nThe last output unuse can therefore drop opened[STR_OUT] to zero and\nrelease the rawmidi file while an in-flight event_input callback is still\ninside snd_rawmidi_kernel_write(). That leaves the rawmidi substream\nruntime exposed to teardown before the write path has taken its own\nbuffer reference.\n\nAdd a per-client rwlock for the event_input-visible output file. Publish\na newly opened output file under the write side, and hold the read side\nfrom the output lookup through snd_rawmidi_kernel_write(). The last\noutput close copies and clears the visible output file under the write\nside, then drops the lock and releases the saved rawmidi file. Use\nIRQ-safe rwlock guards because event_input can also be reached from\natomic sequencer delivery.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\npath A label: event_input path         path B label: last unuse path\n1. seq_ump_process_event() reads       1. seq_ump_client_close()\n   client-\u003eout_rfile.output.              drops opened[STR_OUT] to zero.\n2. snd_rawmidi_kernel_write1()         2. snd_rawmidi_kernel_release()\n   has not yet pinned runtime.            closes the output file.\n3. The writer continues using          3. close_substream() frees\n   the borrowed substream.                substream-\u003eruntime.\n\nThis keeps the output substream and runtime alive for the full\nevent_input write while keeping rawmidi release outside the rwlock.\n\nKASAN reproduced this as a slab-use-after-free in\nsnd_rawmidi_kernel_write1(), with allocation through\nseq_ump_use()/snd_seq_port_connect() and free through\nseq_ump_unuse()/snd_seq_port_disconnect().\n\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400\nRIP: 0033:0x7f5528af837f\nRead of size 8\nCall trace:\n  dump_stack_lvl+0x73/0xb0 (?:?)\n  print_report+0xd1/0x650 (?:?)\n  srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n  __virt_addr_valid+0x1a7/0x340 (?:?)\n  kasan_complete_mode_report_info+0x64/0x200 (?:?)\n  kasan_report+0xf7/0x130 (?:?)\n  snd_rawmidi_kernel_write1+0x9d/0x400 (?:?)\n  __asan_load8+0x82/0xb0 (?:?)\n  update_stack_state+0x1ef/0x2d0 (?:?)\n  snd_rawmidi_kernel_write+0x1a/0x20 (?:?)\n  seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82)\n  __snd_seq_deliver_single_event+0x8a/0xe0 (?:?)\n  snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?)\n  lock_acquire+0x14e/0x2e0 (?:?)\n  find_held_lock+0x31/0x90 (?:?)\n  snd_seq_port_use_ptr+0xa6/0xe0 (?:?)\n  __kasan_check_write+0x18/0x20 (?:?)\n  do_raw_read_unlock+0x32/0xa0 (?:?)\n  _raw_read_unlock+0x26/0x50 (?:?)\n  snd_seq_deliver_single_event+0x45c/0x4b0 (?:?)\n  snd_seq_deliver_event+0x10d/0x1b0 (?:?)\n  snd_seq_client_enqueue_event+0x192/0x240 (?:?)\n  snd_seq_write+0x2cd/0x450 (?:?)\n  apparmor_file_permission+0x20/0x30 (?:?)\n  security_file_permission+0x51/0x60 (?:?)\n  vfs_write+0x1ce/0x850 (?:?)\n  __fget_files+0x12b/0x220 (?:?)\n  lock_release+0xc8/0x2a0 (?:?)\n  __rcu_read_unlock+0x74/0x2d0 (?:?)\n  __fget_files+0x135/0x220 (?:?)\n  ksys_write+0x15a/0x180 (?:?)\n  rcu_is_watching+0x24/0x60 (?:?)\n  __x64_sys_write+0x46/0x60 (?:?)\n  x64_sys_call+0x7d/0x20d0 (?:?)\n  do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime-\u003ebuffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:23.130Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cb1ad795570167558530d6194297ac2396a1991"
        },
        {
          "url": "https://git.kernel.org/stable/c/3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef46b616a4c219185bbf10ebcbacb571583fd0e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/60a1969fae6209644698fca91c185d153674f631"
        }
      ],
      "title": "ALSA: seq: Serialize UMP output teardown with event_input",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64029",
    "datePublished": "2026-07-19T15:39:20.368Z",
    "dateReserved": "2026-07-19T07:54:57.028Z",
    "dateUpdated": "2026-08-05T12:38:23.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64174 (GCVE-0-2026-64174)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-07-19 15:40

Title

wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/5817e1e5205498a5d…
https://git.kernel.org/stable/c/cedbb608494ba1e7a…
https://git.kernel.org/stable/c/c0bc4c8bd556cbe03…
https://git.kernel.org/stable/c/1ced0f5a851f9cae2…
https://git.kernel.org/stable/c/67915715fd3874057…
https://git.kernel.org/stable/c/6cfae4914439878b8…
https://git.kernel.org/stable/c/1343a480f84b80c12…
https://git.kernel.org/stable/c/7666dbb1bacc4ba52…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 5817e1e5205498a5df66eba2b34e817f4210fd0f (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < cedbb608494ba1e7a5c6c56b7f1d3fd470094f28 (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8 (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 1ced0f5a851f9cae274545a42a06c459b7fd8881 (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 67915715fd3874057457363c87c63e18829527df (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 6cfae4914439878b8acb35c7e3b40096eeb2ad9c (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 1343a480f84b80c1249133a90ef87f8751d65cbb (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 7666dbb1bacc4ba522b96740cba7283d243d16e1 (git)
Linux	Linux	Affected: 5.2 Unaffected: 0 , < 5.2 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5817e1e5205498a5df66eba2b34e817f4210fd0f",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "cedbb608494ba1e7a5c6c56b7f1d3fd470094f28",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "1ced0f5a851f9cae274545a42a06c459b7fd8881",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "67915715fd3874057457363c87c63e18829527df",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "6cfae4914439878b8acb35c7e3b40096eeb2ad9c",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "1343a480f84b80c1249133a90ef87f8751d65cbb",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "7666dbb1bacc4ba522b96740cba7283d243d16e1",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: advance loop vars in cfg80211_merge_profile()\n\ncfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS\nprofile that has been split across multiple consecutive MBSSID elements.\nIts while-loop calls\n\n\tcfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)\n\nbut never advances mbssid_elem or sub_elem inside the body.  Each\niteration therefore searches for a continuation that follows the same\nfixed pair; the helper returns the same next_mbssid; and the same\nnext_sub bytes are memcpy()\u0027d into merged_ie at a growing offset until\nthe buffer fills.\n\nAdvance both mbssid_elem and sub_elem to the just-consumed continuation\nso the next call to cfg80211_get_profile_continuation() searches for a\nfurther continuation beyond it (or returns NULL when none exists).\n\nA specially-crafted malicious beacon can take advantage of this bug\nto cause the kernel to spend an excessive amount of time in\ncfg80211_merge_profile (up to as much as 2ms per beacon received),\nwhich could theoretically be abused in some way."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:40:59.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881"
        },
        {
          "url": "https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1"
        }
      ],
      "title": "wifi: cfg80211: advance loop vars in cfg80211_merge_profile()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64174",
    "datePublished": "2026-07-19T15:40:59.360Z",
    "dateReserved": "2026-07-19T07:54:57.039Z",
    "dateUpdated": "2026-07-19T15:40:59.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64175 (GCVE-0-2026-64175)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:41 – Updated: 2026-08-05 12:39

Title

wifi: iwlwifi: mld: stop TX during firmware restart

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/dc31c69476520bb4c…
https://git.kernel.org/stable/c/13f1786395dbbf3df…
https://git.kernel.org/stable/c/2becb38a3e217ef2b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d1e879ec600f9b3bdd253167533959facfefb17b , < dc31c69476520bb4c2a208211a8d3c310a62c4d0 (git) Affected: d1e879ec600f9b3bdd253167533959facfefb17b , < 13f1786395dbbf3df73337063c798f1266be6151 (git) Affected: d1e879ec600f9b3bdd253167533959facfefb17b , < 2becb38a3e217ef2b2f42fddd7db7a25905ec291 (git)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mld/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc31c69476520bb4c2a208211a8d3c310a62c4d0",
              "status": "affected",
              "version": "d1e879ec600f9b3bdd253167533959facfefb17b",
              "versionType": "git"
            },
            {
              "lessThan": "13f1786395dbbf3df73337063c798f1266be6151",
              "status": "affected",
              "version": "d1e879ec600f9b3bdd253167533959facfefb17b",
              "versionType": "git"
            },
            {
              "lessThan": "2becb38a3e217ef2b2f42fddd7db7a25905ec291",
              "status": "affected",
              "version": "d1e879ec600f9b3bdd253167533959facfefb17b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mld/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld-\u003efw_status.in_hw_restart\nto true. However, iwl_mld_tx_from_txq() does not check this flag before\ndequeuing frames from mac80211 and pushing them to the transport layer.\n\nSince the firmware is dead, iwl_trans_tx() returns -EIO for each frame,\nwhich then gets freed immediately. Under high-throughput conditions\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates\nrapid skb allocation churn, leading to memory pressure from slab\nfragmentation.\n\nThe RX path already has this guard (iwl_mld_rx_mpdu checks\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to\niwl_mld_tx_from_txq() to stop all TX during firmware restart.\n\nFrames left in mac80211\u0027s TXQs are naturally drained after restart\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes\nwake_tx_queue.\n\nTested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on\nkernel 6.19.5 where the firmware crashes approximately every 10-15\nminutes under Tailscale traffic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when outbound traffic drives mac80211 TX during firmware restart; a remote attacker can sustain that by sending high-volume packets to the victim over the network, causing responses and continued TX without local access.\nAC:L - An attacker can reliably generate sustained high-throughput traffic that both stresses the iwlwifi MLD firmware and keeps TX queues active during the restart window; on affected Intel Wi-Fi 7 hardware firmware crashes occur frequently under such load.\nPR:N - Exploitation requires only the ability to send network traffic to the victim; no local account, kernel capabilities, or authentication is needed to keep the TX dequeue loop running during firmware restart.\nUI:N - No victim interaction beyond normal network connectivity is required; the attacker can trigger the condition by flooding or sustaining traffic to the target.\nS:U - Impact is confined to kernel/driver resource exhaustion on the affected host and does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The flaw causes skb allocate/free churn and CPU waste but does not corrupt memory, leak kernel data, or provide an out-of-bounds or use-after-free read primitive.\nI:N - Failed transmits are dropped and freed cleanly; there is no arbitrary write, code execution, or integrity compromise beyond dropped packets during the restart window.\nA:H - The missing guard creates a tight dequeue-send-fail-free loop under high throughput during firmware restart, wasting CPU and causing memory pressure from slab fragmentation that can render the system effectively unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:53.411Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151"
        },
        {
          "url": "https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291"
        }
      ],
      "title": "wifi: iwlwifi: mld: stop TX during firmware restart",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64175",
    "datePublished": "2026-07-19T15:41:00.157Z",
    "dateReserved": "2026-07-19T07:54:57.039Z",
    "dateUpdated": "2026-08-05T12:39:53.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68570

CVE-2026-53196 (GCVE-0-2026-53196)

CVE-2026-53239 (GCVE-0-2026-53239)

CVE-2026-63869 (GCVE-0-2026-63869)

CVE-2026-63913 (GCVE-0-2026-63913)

CVE-2026-63917 (GCVE-0-2026-63917)

CVE-2026-63919 (GCVE-0-2026-63919)

CVE-2026-63921 (GCVE-0-2026-63921)

CVE-2026-64029 (GCVE-0-2026-64029)

CVE-2026-64174 (GCVE-0-2026-64174)

CVE-2026-64175 (GCVE-0-2026-64175)

Tags

Sightings

Nomenclature

Related by attack behaviour