Vulnerability-Lookup

RHSA-2026:77498

Vulnerability from csaf_opensuse - Published: 2026-10-07 00:00 - Updated: 2026-10-12 09:50

Summary

security update for kernel

Severity

Important

Notes

Title of the patch: security update for kernel

Description of the patch: This security update provides a functional equivalent of RHSA-2026:77498. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:77498.

Patchnames: RHSA-2026:77498

CVE-2026-64115

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-74582

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2026-64115

Threats

Impact important

CVE-2026-89530

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2026-64115

Threats

Impact important

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-64115/	self
https://www.suse.com/security/cve/CVE-2026-74582/	self
https://www.suse.com/security/cve/CVE-2026-89530/	self
https://www.suse.com/security/cve/CVE-2026-64115	external
https://bugzilla.suse.com/1273745	external
https://bugzilla.suse.com/1273835	external
https://www.suse.com/security/cve/CVE-2026-74582	external
https://bugzilla.suse.com/1275784	external
https://bugzilla.suse.com/1276281	external
https://www.suse.com/security/cve/CVE-2026-89530	external
https://bugzilla.suse.com/1280920	external
https://bugzilla.suse.com/1280921	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:77498.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:77498.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:77498",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_77498.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:77498",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008148.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:77498",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008148.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64115 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64115/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-74582 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-74582/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-89530 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-89530/"
      }
    ],
    "title": "security update for kernel",
    "tracking": {
      "current_release_date": "2026-10-12T09:50:57Z",
      "generator": {
        "date": "2026-10-07T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:77498",
      "initial_release_date": "2026-10-07T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-07T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-10T08:39:26Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-12T09:50:57Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
                "product": {
                  "name": "kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
                  "product_id": "kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-abi-stablelists@4.18.0-553.172.1.el8_10?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
                "product": {
                  "name": "kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
                  "product_id": "kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-doc@4.18.0-553.172.1.el8_10?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bpftool@4.18.0-553.172.1.el8_10?arch=x86_64\u0026upstream=bpftool-0:4.18.0-553.172.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-core@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-cross-headers@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug@4.18.0-553.172.1.el8_10?arch=x86_64\u0026upstream=kernel-debug-0:4.18.0-553.172.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-core@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-debug-devel@4.18.0-553.172.1.el8_10?arch=x86_64\u0026upstream=kernel-debug-0:4.18.0-553.172.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-modules@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-debug-modules-extra@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:linux:linux_kernel:4.18.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/kernel-devel@4.18.0-553.172.1.el8_10?arch=x86_64\u0026upstream=kernel-source-0:4.18.0-553.172.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-headers@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-modules@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-modules-extra@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/kernel-tools-libs-devel@4.18.0-553.172.1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perf-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "perf-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "perf-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perf@4.18.0-553.172.1.el8_10?arch=x86_64\u0026upstream=perf-0:4.18.0-553.172.1.el8_10.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-perf-0:4.18.0-553.172.1.el8_10.x86_64",
                "product": {
                  "name": "python3-perf-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_id": "python3-perf-0:4.18.0-553.172.1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python3-perf@4.18.0-553.172.1.el8_10?arch=x86_64\u0026upstream=perf-0:4.18.0-553.172.1.el8_10.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bpftool-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch"
        },
        "product_reference": "kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-core-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-doc-0:4.18.0-553.172.1.el8_10.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch"
        },
        "product_reference": "kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perf-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "perf-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-perf-0:4.18.0-553.172.1.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
        },
        "product_reference": "python3-perf-0:4.18.0-553.172.1.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-64115",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64115"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt-\u003etype == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener\u0027s pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n  BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n  Write of size 4 at addr ffff88800b1cac80 by task kworker\n  Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err \u003c 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference.  This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err \u003c 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -\u003e 0/100 patched.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64115",
          "url": "https://www.suse.com/security/cve/CVE-2026-64115"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273745 for CVE-2026-64115",
          "url": "https://bugzilla.suse.com/1273745"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273835 for CVE-2026-64115",
          "url": "https://bugzilla.suse.com/1273835"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-07T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-64115"
    },
    {
      "cve": "CVE-2026-74582",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-74582"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-74582",
          "url": "https://www.suse.com/security/cve/CVE-2026-74582"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275784 for CVE-2026-74582",
          "url": "https://bugzilla.suse.com/1275784"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276281 for CVE-2026-74582",
          "url": "https://bugzilla.suse.com/1276281"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-07T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-74582"
    },
    {
      "cve": "CVE-2026-89530",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-89530"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice\u0027s Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client\u0027s\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device\u0027s SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
          "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
          "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-89530",
          "url": "https://www.suse.com/security/cve/CVE-2026-89530"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280920 for CVE-2026-89530",
          "url": "https://bugzilla.suse.com/1280920"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280921 for CVE-2026-89530",
          "url": "https://bugzilla.suse.com/1280921"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:bpftool-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-abi-stablelists-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-cross-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-core-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-debug-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-doc-0:4.18.0-553.172.1.el8_10.noarch",
            "SUSE Liberty Linux 8:kernel-headers-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-modules-extra-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:kernel-tools-libs-devel-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:perf-0:4.18.0-553.172.1.el8_10.x86_64",
            "SUSE Liberty Linux 8:python3-perf-0:4.18.0-553.172.1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-07T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-89530"
    }
  ]
}

CVE-2026-64115 (GCVE-0-2026-64115)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39

Title

vsock/vmci: fix UAF when peer resets connection during handshake

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6619 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/1e19f08552b90070e…
https://git.kernel.org/stable/c/1dd531e28f61edd28…
https://git.kernel.org/stable/c/ecda37f8faab3220d…
https://git.kernel.org/stable/c/cc27e989a5dfdfcfc…
https://git.kernel.org/stable/c/47e63077605c6c2aa…
https://git.kernel.org/stable/c/440447699c681e26e…
https://git.kernel.org/stable/c/9fe74e42914c851d6…
https://git.kernel.org/stable/c/99e22ddf4edb63dc8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 1e19f08552b90070ed18bafb1763c78297823af6 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 1dd531e28f61edd286edc486ab068f135b5ae1eb (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < ecda37f8faab3220da199335e42564cb7a9ad145 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 440447699c681e26ed58e9c309cad718270a18b4 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 9fe74e42914c851d68069713b7b917a9c33faf26 (git) Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 99e22ddf4edb63dc8382bc028af928056d3450cf (git)
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/vmci_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1e19f08552b90070ed18bafb1763c78297823af6",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "1dd531e28f61edd286edc486ab068f135b5ae1eb",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "ecda37f8faab3220da199335e42564cb7a9ad145",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "440447699c681e26ed58e9c309cad718270a18b4",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "9fe74e42914c851d68069713b7b917a9c33faf26",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "99e22ddf4edb63dc8382bc028af928056d3450cf",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/vmci_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt-\u003etype == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener\u0027s pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n  BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n  Write of size 4 at addr ffff88800b1cac80 by task kworker\n  Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err \u003c 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference.  This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err \u003c 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -\u003e 0/100 patched."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object\u0027s refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:24.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26"
        },
        {
          "url": "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf"
        }
      ],
      "title": "vsock/vmci: fix UAF when peer resets connection during handshake",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64115",
    "datePublished": "2026-07-19T15:40:15.513Z",
    "dateReserved": "2026-07-19T07:54:57.035Z",
    "dateUpdated": "2026-08-05T12:39:24.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74582 (GCVE-0-2026-74582)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-27 12:39

Title

packet: use consistent hard_header_len in non-ring send paths

Summary

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6619 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/bcd4df60ac9481b1c…
https://git.kernel.org/stable/c/78a47127e33c340bc…
https://git.kernel.org/stable/c/142e287b3a25cfe90…
https://git.kernel.org/stable/c/91f041451f967cd87…
https://git.kernel.org/stable/c/9052756290962ffb9…
https://git.kernel.org/stable/c/5bb10753d428aadfc…
https://git.kernel.org/stable/c/b06b6fce6d7deaf72…
https://git.kernel.org/stable/c/03390aa32e669cc4e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 78a47127e33c340bc6d38dcc4552a094b4f5cc77 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 142e287b3a25cfe909215177c23243e7fc5ae2b1 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 91f041451f967cd87ed722a8f43c0b767a64f1a0 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 9052756290962ffb9a661bcf319e92dedaaedfed (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 5bb10753d428aadfc356a2bfe9acea09c82a62ec (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < b06b6fce6d7deaf7238e09b48ce3b1125ff41acd (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 03390aa32e669cc4ecd7d34108e2e1afc13d689d (git) Affected: d9fb8cc230b2a4757e9fe4f81468f81212d4deaa (git) Affected: 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 (git) Affected: 01a658c1b9d4b5393c38d5a92d9112ab1425382a (git) Affected: 8809ae6747e760e6f1d2453ceb08c9bcc4939766 (git) Affected: 4.4.133 , < 4.5 (semver) Affected: 4.9.103 , < 4.10 (semver) Affected: 4.14.44 , < 4.15 (semver) Affected: 4.16.12 , < 4.17 (semver)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.267 , ≤ 5.10.* (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.1.185 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.133",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.133",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.16.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb-\u003edata before skb-\u003ehead, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:47.499Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812"
        },
        {
          "url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77"
        },
        {
          "url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
        },
        {
          "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
        }
      ],
      "title": "packet: use consistent hard_header_len in non-ring send paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74582",
    "datePublished": "2026-08-21T16:31:55.283Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-27T12:39:47.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89530 (GCVE-0-2026-89530)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30

Title

svcrdma: Reject inline replies that overflow the pull-up buffer

Summary

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more scatter/gather entries than the device's Send Queue supports, svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size bytes, while the reply on this path is bounded only by the client's request, so svc_rdma_xb_linearize() copies past the end of the buffer and corrupts adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, so the device also reads beyond the mapped region. The SGE-exhaustion branch is the only pull-up path that can exceed the buffer: the threshold branch pulls up only replies smaller than RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE budget are sent directly without linearization. Make svc_rdma_pull_up_needed() report -E2BIG when the reply it would pull up cannot fit sc_max_req_size, and fail the request with ERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping the connection. The helper no longer answers a simple yes/no question: it now reports pull-up, no pull-up, or -E2BIG for a reply too large to linearize. Rename svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() so its name no longer implies a boolean predicate.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6619 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/fcd91b9957462d398…
https://git.kernel.org/stable/c/1949dd1576f7a8aa1…
https://git.kernel.org/stable/c/8ec60eb51fae37cd3…
https://git.kernel.org/stable/c/0fbe20dfe74b783d2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e248aa7be86e8179f20ac0931774ecd746f3f5bf , < fcd91b9957462d398792201c239dffaeff1cc8b2 (git) Affected: e248aa7be86e8179f20ac0931774ecd746f3f5bf , < 1949dd1576f7a8aa161b1330c6125df9d53046d5 (git) Affected: e248aa7be86e8179f20ac0931774ecd746f3f5bf , < 8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf (git) Affected: e248aa7be86e8179f20ac0931774ecd746f3f5bf , < 0fbe20dfe74b783d255bf389a6ea77aa25dc7860 (git) Affected: 9b65b18f817d9ada2bf67351f24bdcce6789a0bb (git) Affected: d564356e1919d1178568c19af410cfc1a9076663 (git) Affected: 4.19.22 , < 4.20 (semver) Affected: 4.20.9 , < 4.21 (semver)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_sendto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fcd91b9957462d398792201c239dffaeff1cc8b2",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "1949dd1576f7a8aa161b1330c6125df9d53046d5",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "0fbe20dfe74b783d255bf389a6ea77aa25dc7860",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b65b18f817d9ada2bf67351f24bdcce6789a0bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d564356e1919d1178568c19af410cfc1a9076663",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.22",
              "versionType": "semver"
            },
            {
              "lessThan": "4.21",
              "status": "affected",
              "version": "4.20.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_sendto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.20.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice\u0027s Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client\u0027s\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device\u0027s SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote NFS/RDMA client reaches svc_rdma_sendto over InfiniBand, RoCE, or iWARP, including IP-routable RoCEv2/iWARP and Soft-RoCE, so this is a network attack.\nAC:L - The attacker fully controls omitting the Write list and Reply chunk and the NFS READ size; with the default 4096-byte pull-up buffer and ~5 Send SGEs, a multi-page inline READ deterministically takes the SGE-exhaustion pull-up path and overflows, with no race or uncontrollable layout.\nPR:N - RDMA-CM accept has no credential check, and AUTH_NULL/AUTH_UNIX need no real account; default NFS exports accept those flavors, so a fabric peer can drive a large READ reply without local or init-namespace privileges.\nUI:N - Exploitation requires only attacker-sent RPC-over-RDMA Calls that elicit a large inline reply; no victim mount, click, or other user action is needed beyond nfsd already listening on RDMA.\nS:U - The kmalloc overflow and oversized RDMA Send stay inside the host kernel\u0027s security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - svc_rdma_xb_linearize() copies past kmalloc sc_xprt_buf, then the inflated sc_sges[0].length is posted with the PD local DMA lkey, so the device reads adjacent kernel memory onto the wire; the heap smash is also leveragable for disclosure.\nI:H - The unbounded memcpy is a heap out-of-bounds write of attacker-influenced NFS READ payload into adjacent slab objects, enabling corruption of neighboring kernel state and control-flow hijacking.\nA:H - Overflowing a 4KB send buffer by up to the NFS/RDMA max payload smashes adjacent slab and can oops or panic, and posting an SGE longer than the DMA mapping can also fault the device or kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:27.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"
        }
      ],
      "title": "svcrdma: Reject inline replies that overflow the pull-up buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89530",
    "datePublished": "2026-09-11T19:44:10.024Z",
    "dateReserved": "2026-09-11T19:38:34.719Z",
    "dateUpdated": "2026-09-13T06:30:27.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:77498

CVE-2026-64115 (GCVE-0-2026-64115)

CVE-2026-74582 (GCVE-0-2026-74582)

CVE-2026-89530 (GCVE-0-2026-89530)

Tags

Sightings

Nomenclature

Related by attack behaviour