{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:24:50.502778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:45.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce0e675907b887db2b1e44a806118b0a7d8b6b18",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "a3a0cc83761e46a75b1ed6bfaf35961f2c211148",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "2a5206992f526178881e8f5c4644757c336fb76d",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "7ceb6f7cb8f8f2b094e0dcdaf75757775d231378",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "58b23fc9fb580432470d6c5da3c1e5660dba9fbc",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "b10015807e4c628095d1d1d1c9307efc8cdd9e1b",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "69bfe810ecd1e0387d8975d711cd326341d13c6e",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            },
            {
              "lessThan": "b8e5dc4f95e5484159b343903f302eb6d783f2e6",
              "status": "affected",
              "version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions\n\nWhen a file has the setuid or setgid bit set and is written to, the VFS\nstrips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID\ntogether with an ATTR_MODE carrying the already-cleared mode.\n\nBoth cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped\nATTR_MODE in that case:\n\n\t/* skip mode change if it\u0027s just for clearing setuid/setgid */\n\tif (attrs-\u003eia_valid \u0026 (ATTR_KILL_SUID|ATTR_KILL_SGID))\n\t\tattrs-\u003eia_valid \u0026= ~ATTR_MODE;\n\nThis is fine for the default mount, where the mode is only emulated via\nthe DOS read-only attribute and cannot represent the setuid/setgid bits\nanyway.  However, with the \"cifsacl\" or \"modefromsid\" mount options the\nmode is stored on the server through an ACL (id_mode_to_cifs_acl()), with\nthe SMB3.1.1 POSIX extensions the mode is sent to the server directly,\nand with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent\nvia CIFSSMBUnixSetPathInfo().  In all those cases dropping ATTR_MODE means\nthe cleared mode is never pushed to the server, so the setuid/setgid bit\nsurvives the write.\n\nThis is a security issue: on local filesystems the setuid bit is stripped\nwhen a file is written, but over these cifs.ko mounts the bit persists on\nthe server, potentially allowing an unexpected privilege escalation on\nsubsequent execution.\n\nFix this in two places:\n\n  1. cifs_setattr_nounix(): only take the \"skip mode change\" shortcut\n     when the mode is emulated via the DOS read-only attribute (i.e.\n     neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are\n     in effect), so that the cleared mode is propagated to the server\n     in the ACL / POSIX cases.\n\n  2. cifs_setattr_unix(): this function is only called when Unix\n     extensions are in effect, so the mode is always stored on the\n     server.  Remove the shortcut entirely so that the cleared mode is\n     always pushed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the CIFS client setattr path, reached by local write(2)/truncate(2) on an SMB mount: cifs_file_write_iter -\u003e netfs_file_write_iter -\u003e file_remove_privs -\u003e notify_change -\u003e cifs_setattr_unix/nounix. This is not ksmbd; a remote SMB peer cannot invoke the ATTR_MODE skip.\nAC:L - Once the share stores POSIX mode (cifsacl, modefromsid, SMB3.1.1 POSIX, or SMB1 Unix extensions), a write to a setuid/setgid file deterministically drops ATTR_MODE so the cleared bits are never pushed. The attacker controls the write and later exec, with no race or uninfluenced memory layout.\nPR:L - An unprivileged local user with write access to the setuid/setgid file (group/world-writable helper, or noperm) triggers file_remove_privs; ATTR_FORCE skips ownership/CAP_FSETID checks in setattr_prepare, and no init-namespace capability is required.\nUI:N - The attacker opens, writes, and execve()s the still-setuid file on an already-mounted share; no other user must mount the filesystem, confirm a prompt, or run the binary.\nS:U - Remaining setuid/setgid execution escalates privileges inside the same kernel/OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After the attacker overwrites a privileged setuid/setgid helper, the uncleared bits allow execve of attacker-controlled contents as the file owner (including root on Samba POSIX/cifsacl deployments), disclosing all data that owner can read.\nI:H - The same still-setuid execution runs attacker-supplied file contents with the owner\u0027s privileges, enabling arbitrary writes and full integrity compromise, which is the POSIX reason those bits are stripped on write.\nA:H - Attacker-controlled code running as the privileged file owner can panic, halt, or disable the host, so successful exploitation yields complete availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:32:23.806Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce0e675907b887db2b1e44a806118b0a7d8b6b18"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3a0cc83761e46a75b1ed6bfaf35961f2c211148"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a5206992f526178881e8f5c4644757c336fb76d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ceb6f7cb8f8f2b094e0dcdaf75757775d231378"
        },
        {
          "url": "https://git.kernel.org/stable/c/58b23fc9fb580432470d6c5da3c1e5660dba9fbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6"
        }
      ],
      "title": "smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89638",
    "datePublished": "2026-09-11T19:45:31.791Z",
    "dateReserved": "2026-09-11T19:38:34.740Z",
    "dateUpdated": "2026-10-30T12:32:23.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb84cd81040e58dd05ac190f561f2115e3367249",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "f0eea8f9013676b42289ec35941e848b8a543e19",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "d665a1688af7f8fefd7c0eb04f2a37122ce007f4",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "25cdd2a492d868cff1e519a60fe282909c52d385",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "812f1db7f0755a19ef16ecdc5cec51bcabc5eda5",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "533d0c5feef85ee6404b9f41d5564fac6971a008",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "fda8fb7e8179561693a786a7af593f6b944a21c1",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "dc77acfeb979dded39b247b60fef0399536bfa77",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac370e3d1f3b01519d2705cd5815d1c9d0a8812b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be363e27ec3c3a99793da2be6c07eafb95709c6b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1b10ba5739440ca51d66f0b2949cead88d2dd02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde3433de9a067a33d67d65b9093cad3e043e49e",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.155",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.85",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.155",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.85",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\n\nvfio_msi_cap_len() lazily allocates the per-device MSI permission table:\n\n\tvdev-\u003emsi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);\n\tif (!vdev-\u003emsi_perm)\n\t\treturn -ENOMEM;\n\n\tret = init_pci_cap_msi_perm(vdev-\u003emsi_perm, len, flags);\n\tif (ret) {\n\t\tkfree(vdev-\u003emsi_perm);\n\t\treturn ret;\t\t/* vdev-\u003emsi_perm left dangling */\n\t}\n\nWhen init_pci_cap_msi_perm() -\u003e alloc_perm_bits() fails with -ENOMEM, the\nerror path frees vdev-\u003emsi_perm but leaves the freed pointer stored in\nit. vdev-\u003emsi_perm is not re-zeroed later because struct\nvfio_pci_core_device is per-device and persists across open/close cycles,\nand the vfio_config_init() error path returns without calling\nvfio_config_free(). So the dangling pointer outlives the failed open.\n\nThat leads to two use-after-frees on the same device:\n\n1. Reuse. The next vfio_config_init() sees the stale pointer at\n   \"if (vdev-\u003emsi_perm) return len;\" and reuses the freed object. MSI\n   config accesses in vfio_pci_config_rw_single() then dereference and\n   call the freed perm-\u003ereadfn / perm-\u003ewritefn function pointers.\n\n2. Double free. A later vfio_config_free() runs free_perm_bits() and\n   kfree() on the already-freed object.\n\nFix it by NULLing vdev-\u003emsi_perm after the kfree(), matching the\nNULL-after-free discipline already used in free_perm_bits() and\nvfio_config_free().\n\n  BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n  Read of size 8 at addr ffff88800fcc88d0 by task exploit/143\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n   vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)\n   vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)\n   vfs_read (fs/read_write.c:572)\n   __x64_sys_pread64 (fs/read_write.c:764)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n\nFollowed on device close by a double free of the same object:\n\n  Oops: general protection fault, probably for non-canonical address\n    0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:kfree (mm/slub.c:6711)\n  Call Trace:\n   vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)\n   vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)\n   vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)\n   vfio_df_close (drivers/vfio/vfio_main.c:602)\n   vfio_device_fops_release (drivers/vfio/vfio_main.c:648)\n   __fput (fs/file_table.c:512)\n   __x64_sys_close (fs/open.c:1496)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only via local VFIO char-device operations: open of /dev/vfio/$GROUP or /dev/vfio/devices/vfioN, then pread/pwrite of the PCI config region through vfio_pci_core_read/write into vfio_pci_config_rw_single(). There is no network or packet path into vfio_msi_cap_len().\nAC:L - After any failed vfio_config_init() plants the dangling vdev-\u003emsi_perm, the attacker retries GET_DEVICE_FD/BIND_IOMMUFD on the same persistent vdev and deterministically calls the freed perm-\u003ereadfn/writefn via MSI config accesses. The attacker controls that open/read sequence; no victim race or uncontrolled layout is required.\nPR:L - vfio_pci_core_enable() and vfio_pci_config_rw() have no capable() check on the normal IOMMU path (CAP_SYS_RAWIO is only for noiommu). Access is gated by /dev/vfio node permissions, which libvirt, kubevirt, and cloud GPU/NIC passthrough routinely grant to an unprivileged qemu user or tenant.\nUI:N - The attacker performs the VFIO open, retry, and MSI config-space pread/pwrite themselves. Prior admin binding of the PCI device to vfio-pci is deployment configuration, not victim interaction during exploitation.\nS:C - struct vfio_pci_core_device persists across open/close, so a failed open can leave a dangling msi_perm that a later tenant VM reuses. QEMU services guest PCI config cycles with VFIO pread/pwrite, so a passthrough guest can invoke the freed host function pointers and cross the VFIO/IOMMU guest-to-host boundary.\nC:H - The next successful open reuses the freed perm_bits and MSI config reads call perm-\u003ereadfn on that object. Reclaiming the slab slot yields an arbitrary kernel-read primitive, which CVSS kernel guidance scores High for use-after-free.\nI:H - MSI config writes call the freed perm-\u003ewritefn, and a later close double-frees the same object in vfio_config_free(). That UAF/double-free of a structure with function pointers is exploitable for arbitrary kernel write and control-flow hijack.\nA:H - The report shows a KASAN slab-use-after-free in vfio_pci_config_rw_single() followed by a general-protection fault in kfree() during vfio_config_free() that panics the host, so availability impact is a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:52:29.546Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385"
        },
        {
          "url": "https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5"
        },
        {
          "url": "https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77"
        }
      ],
      "title": "vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89777",
    "datePublished": "2026-09-16T08:48:17.754Z",
    "dateReserved": "2026-09-11T19:38:34.765Z",
    "dateUpdated": "2026-10-19T08:52:29.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5-ppl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf01f9413565e86673baf927291a088b6975692b",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "e7505842f1329ece90cb9ea0db87772aeca44052",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "b5123bf667ac29ddd8106f9ca7cc01316513ae66",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "e77c80670f2c2bf491da9b173931e1da4677c23a",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "8914c3d40870f16429a326e97e4016bedc6ede4c",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "455b56209f9615c3902dcc398dd867abb5ade3ab",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "fcf21df7d3c50c8ebeb0757df5d21b02dcae4218",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            },
            {
              "lessThan": "371f7a1b392edc8b7cf449cc7713179b588f2d0e",
              "status": "affected",
              "version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5-ppl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io-\u003epending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The patched ppl_do_flush() runs from ppl_stripe_write_finished() after RAID5 stripe data+parity I/O completes. Those writes enter via md_submit_bio() -\u003e raid5_make_request() from local write(2) to a filesystem or /dev/md*; ppl_submit_iounit() only sets disk_flush_bitmap from local stripe R5_Wantwrite/wb_cache_on state, not from a network protocol message.\nAC:L - Writes the attacker issues are logged by ppl_write_stripe()/ppl_log_stripe() and ppl_submit_iounit() sets disk_flush_bitmap for child_logs[i].wb_cache_on members. When pending_stripes hits 0, ppl_stripe_write_finished() calls ppl_do_flush(); the remainder loop\u0027s missing break after ppl_io_unit_finished() is a logic bug on that path, not a second-actor race or a disk-fault precondition.\nPR:L - md_submit_bio() and raid5_make_request() have no capability check; md_ioctl()\u0027s capable(CAP_SYS_ADMIN) applies only to array-management ioctls, not I/O. An unprivileged user who can write a filesystem on the RAID5+PPL array (or /dev/md* with disk-group write access) reaches ppl_do_flush() without init-namespace root.\nUI:N - The attacker triggers ppl_do_flush() through their own writes: raid5 handle_stripe()/handle_stripe_clean_event() calls ppl_stripe_write_finished() on I/O they submitted. No victim action such as mounting an image or plugging a device is required.\nS:U - ppl_io_unit_finished() mempool_free()s the ppl_io_unit from ppl_conf-\u003eio_pool in the host md/raid5 kernel. The later dangling atomic_dec_and_test(\u0026io-\u003epending_flushes) in ppl_do_flush() stays in that kernel\u0027s authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - ppl_io_unit_finished() returns the ppl_io_unit to io_pool via mempool_free(); ppl_do_flush()\u0027s remainder loop then does atomic_dec_and_test(\u0026io-\u003epending_flushes) on that freed kmem_cache object. A UAF of the recycled io_unit header is a kernel read primitive against adjacent/reconstituted pool memory.\nI:H - The same dangling io is a writeable ppl_io_unit: atomic_dec_and_test() mutates pending_flushes on a recycled object, and another true dec_and_test would call ppl_io_unit_finished() again (list_del/mempool_free of a live unit). That is a kernel write/double-free primitive on the PPL io_unit cache.\nA:H - Use-after-free of the mempool ppl_io_unit in ppl_do_flush() after ppl_io_unit_finished() can oops on the stale pending_flushes access or corrupt list_del() pointers in a second finish, panicking the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:08:15.484Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66"
        },
        {
          "url": "https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218"
        },
        {
          "url": "https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e"
        }
      ],
      "title": "md/raid5-ppl: fix use-after-free in ppl_do_flush()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93262",
    "datePublished": "2026-09-24T15:52:01.886Z",
    "dateReserved": "2026-09-17T16:02:15.097Z",
    "dateUpdated": "2026-10-19T09:08:15.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/encrypted-keys/encrypted.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1e720f63dbafc093a8f5d519f05b67724993edd4",
              "status": "affected",
              "version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
              "versionType": "git"
            },
            {
              "lessThan": "a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0",
              "status": "affected",
              "version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
              "versionType": "git"
            },
            {
              "lessThan": "cca38f2102a4cd35eda8d48950df4817b4b24757",
              "status": "affected",
              "version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
              "versionType": "git"
            },
            {
              "lessThan": "8697c431e297eb0d0ab13dda6bc172b48a34f05c",
              "status": "affected",
              "version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/encrypted-keys/encrypted.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: encrypted: fix integer overflow of datablob_len\n\nencrypted_key_alloc() stores datablob_len in a u16. It is computed from\nmultiple string and payload lengths. If the result exceeds U16_MAX, the\nassignment truncates the allocation size. KASAN reports a 32760-byte\nslab-out-of-bounds write when __ekey_init() copies the master key\ndescription into the undersized buffer.\n\nThe total payload length stored in key-\u003edatalen is also a u16. Use\ncheck_add_overflow() to reject values that do not fit either destination,\nand use kzalloc_flex() for the flexible-array allocation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:15:54.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757"
        },
        {
          "url": "https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"
        }
      ],
      "title": "KEYS: encrypted: fix integer overflow of datablob_len",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98222",
    "datePublished": "2026-10-06T08:44:57.621Z",
    "dateReserved": "2026-09-25T10:25:14.327Z",
    "dateUpdated": "2026-10-19T09:15:54.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "93ff1594be1aad4da364462dd8db050ebcfda2de",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "eed6997e8dc40593a539fcc722e7ed51b18db86c",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "61c6688be282277c6e91ab286a7acd0ae8681ac6",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "a43cd2b67b91e943273c913237a7a88c50cdcfbc",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "8274cdc5f9c57e17ed77fc4ba76212536c840f25",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "12c1ac230f4ca16e0017b62a963ab75e0b48074f",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "d9e6175a3ee48209ee65f294fc567b4e16b29b74",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The freed ct is reached from nf_flow_offload_forward() (nf_ct_acct_update/flow_offload_teardown on flow-\u003ect) but freeing it needs the conntrack killed (nf_ct_is_dying) and flow_offload_del() run; a remote peer only supplies forwarded packets and cannot kill an offloaded ct, so the full trigger needs local nftables/ctnetlink access.\nAC:L - The attacker drives every side of the race: they flood packets through their own flowtable, delete the ct via ctnetlink, and force nf_flow_offload_gc_step()-\u003eflow_offload_del() at once by downing the veth (nf_flow_table_gc_cleanup flush_delayed_work). The window is narrow but can be retried indefinitely.\nPR:L - Creating the nftables flowtable, adding veth forwarding and sending IPCTNL_MSG_CT_DELETE need only CAP_NET_ADMIN in a network namespace, which an unprivileged user gets via unshare -Urn.\nUI:N - No victim action is needed; the attacker sets up the flowtable, the traffic and the conntrack/flow teardown entirely within their own namespace.\nS:U - Memory corruption in the host kernel\u0027s netfilter flowtable/conntrack objects yields kernel privilege escalation within the same authority; no VM or hardware boundary is crossed.\nC:H - flow_offload_free() dropped the ct reference before the RCU grace period, so in-flight readers dereference ct-\u003eext after nf_conntrack_free() has kfree\u0027d it, or a recycled SLAB_TYPESAFE_BY_RCU nf_conn now owned by another connection - a use-after-free that can be groomed to leak kernel memory.\nI:H - The stale reader writes freed or reused memory: nf_ct_acct_add() does atomic64_add into the freed ct-\u003eext counters, and flow_offload_teardown()/flow_offload_fixup_ct() modify status/timeout of a recycled conntrack, giving heap-corruption primitives.\nA:H - The use-after-free on ct-\u003eext and recycled nf_conn objects in the forwarding softirq can corrupt the slab and crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:17:30.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de"
        },
        {
          "url": "https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c"
        },
        {
          "url": "https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74"
        },
        {
          "url": "https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d"
        }
      ],
      "title": "netfilter: flowtable: hold reference on ct until flow is released",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98320",
    "datePublished": "2026-10-06T08:46:14.757Z",
    "dateReserved": "2026-09-25T10:25:14.340Z",
    "dateUpdated": "2026-10-19T09:17:30.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}