{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:42:09.809089Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:48:39.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_cdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8de4f665d0febfb92803dece377791a563fc7041",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "8145b432136285e01091815b48ceb2dae261f262",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "1951bffbc6493ec34cff3956b29d4bc6606904a6",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "647b19e5cc145a2f1f685ae8ff3805a17356888c",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "472e9d7c0d5b03be3ff91ff941f57da822b031bc",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "ce5aa8084329351086894aa34d77e40301d5bd3d",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "9d160b35cc34a2ba8229d07651468a7848325135",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_cdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup\u0027s conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(\u0026smc-\u003esk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -\u003e smc_release() -\u003e smc_conn_free() -\u003e smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler\u0027s later\nsock_hold() runs on freed memory:\n\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate\n  Workqueue: rxe_wq do_work\n   refcount_warn_saturate (lib/refcount.c:25)\n   smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n   smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n   smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n   tasklet_action_common (kernel/softirq.c:938)\n   handle_softirqs (kernel/softirq.c:622)\n  Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(\u0026conn-\u003erx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -\u003e `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials \u2014 SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 \u003c= bytes_to_rcv \u003c= rmb_desc-\u003elen` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn-\u003eurg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:17.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"
        },
        {
          "url": "https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"
        },
        {
          "url": "https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"
        },
        {
          "url": "https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"
        }
      ],
      "title": "net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64541",
    "datePublished": "2026-07-27T20:10:34.439Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-10-19T20:48:39.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:45:25.940723Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:55.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/protocol.c",
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4",
              "status": "affected",
              "version": "10c869a52f266e40f548cc3c565d14930a5edafc",
              "versionType": "git"
            },
            {
              "lessThan": "ceb7190b5c873d4a1267a1600c5aa52c600e929f",
              "status": "affected",
              "version": "dc583e7e5f8515ca489c0df28e4362a70eade382",
              "versionType": "git"
            },
            {
              "lessThan": "fd66854a22661929245f3d2b244c432bc8b1a150",
              "status": "affected",
              "version": "bd2a2939423566c654545fa3e96a656662a0af9e",
              "versionType": "git"
            },
            {
              "lessThan": "158f3cc332dc53f43ec20060233d7c3cecd6d912",
              "status": "affected",
              "version": "1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
              "versionType": "git"
            },
            {
              "lessThan": "66700c0719675e0e118ae83b2d7168dacd69dd3d",
              "status": "affected",
              "version": "7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
              "versionType": "git"
            },
            {
              "lessThan": "626bda8cfe43dff19a9833ff6ba055a817b5455c",
              "status": "affected",
              "version": "c184bc621e3cef03ac9ba81a50dda2dae6a21d36",
              "versionType": "git"
            },
            {
              "lessThan": "be6aae9d1b91c603adb35872d37d40e83daf8758",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "a50e73488e0bbdd262b3be3c9a1d8dd078382381",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "f8d5e7846025f4ab15a461235f8ebae9094a361a",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.292",
              "status": "affected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.266",
              "status": "affected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/protocol.c",
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "5.4.290",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.10.234",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.177",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered only by writing the per-net sysctl net.sctp.auth_enable via /proc/sys (proc_sctp_do_auth); it is not reachable from SCTP packet receive, sockets, or other remote protocol paths.\nAC:L - An attacker can open the sysctl file, concurrently destroy the target network namespace, and repeatedly write during teardown; pernet exit destroys ctl_sock before unregistering sysctls, and the attacker controls both sides of that race.\nPR:L - Exploitation requires writing a mode 0644 sysctl in a network namespace; an unprivileged host user with CAP_NET_ADMIN via user namespaces can create a netns, become namespace root, and write net/sctp/auth_enable without init-namespace privileges.\nUI:N - No victim interaction is required beyond the attacker opening the sysctl and triggering namespace teardown in their own threads or processes.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same host/kernel security domain; it does not cross VM, container, or IOMMU boundaries by itself.\nC:H - proc_sctp_do_auth dereferences net-\u003esctp.ctl_sock after inet_ctl_sock_destroy; lock_sock and sctp_sk(sk)-\u003eep access freed socket/endpoint memory, a use-after-free that can disclose or infer heap contents.\nI:H - On a successful write, the handler sets sctp_sk(sk)-\u003eep-\u003eauth_enable on a freed endpoint object, giving a controlled heap write primitive that can be developed into arbitrary kernel modification or code execution.\nA:H - Use-after-free on the SCTP control socket/endpoint during sysctl processing can cause kernel oops/panic from lock_sock or ep access on freed memory, even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:01.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150"
        },
        {
          "url": "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912"
        },
        {
          "url": "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c"
        },
        {
          "url": "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758"
        },
        {
          "url": "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a"
        }
      ],
      "title": "sctp: avoid auth_enable sysctl UAF during netns teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68162",
    "datePublished": "2026-08-10T11:59:29.099Z",
    "dateReserved": "2026-07-30T09:28:09.372Z",
    "dateUpdated": "2026-10-19T20:58:55.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:11.874669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:10.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7dc306ff7c4d951582adaae65e0aee9fb4968dbe",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "447a37a6bef11bfd3645069e380460b11386e2b9",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "f0831f13c42c1261d449dcee8a035e1c6cd9fcaa",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "013a4484f061a2b41f052e25c0015203287e63f1",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "8fa3e9435a13c335efb63fb4f4e77531a0031159",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "a9ae0f6dd45c3ccc1d69363f7aea8af179122730",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA ECC private key requests\n\ncca_ecc2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the `/dev/pkey` misc device via the PKEY_KBLOB2PROTK/PROTK2/PROTK3 ioctls, requiring local access to the s390 system; there is no remote or network-facing path into cca_ecc2protkey().\nAC:L - The attacker fully controls both the overflow length and the overflowing bytes by crafting the ECC key token\u0027s `len` field and blob contents, and the memcpy executes deterministically on every call with no race, timing, or layout precondition.\nPR:L - The pkey misc device is registered with mode 0666 and pkey_unlocked_ioctl performs no capability check, so any unprivileged local user (or a container/sandbox process with the node visible) can issue the ioctl.\nUI:N - The attacker triggers the overflow entirely from its own ioctl call; no action by another user or administrator is needed.\nS:U - The heap corruption occurs in kernel memory within the same security authority; no VM, IOMMU, or other trust boundary is crossed by the overflow itself.\nC:H - The controlled slab overflow can overwrite adjacent kernel objects (pointers, lengths, credentials) with attacker-chosen data, which is readily leveraged into arbitrary kernel memory disclosure, including protected/secure key material handled by this subsystem.\nI:H - memcpy() writes up to ~7 KB of fully attacker-controlled data past a kmalloc\u0027d CPRB buffer, giving a classic controlled heap out-of-bounds write usable for corrupting neighbouring slab objects and achieving privilege escalation or control-flow hijack.\nA:H - Even without reliable exploitation, the oversized memcpy smashes the slab and neighbouring allocations, causing memory corruption, SLUB/redzone BUG detonations, oops or kernel panic, repeatedly triggerable by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:48.084Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7dc306ff7c4d951582adaae65e0aee9fb4968dbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/447a37a6bef11bfd3645069e380460b11386e2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0831f13c42c1261d449dcee8a035e1c6cd9fcaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730"
        }
      ],
      "title": "s390/zcrypt: Validate length for CCA ECC private key requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68451",
    "datePublished": "2026-08-13T13:59:53.674Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-10-19T21:09:10.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:15.916334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:11.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be037204e4f595e4bd2159acda146677a1dc6342",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "4e500ecb6704d879f9c2417c2ed6faba595015ca",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "7f9e5a3dbb14a9b321a1dfa30390402c673f82dc",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "406b317ea2b501f6f5eca1264293c9399a73a778",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "4fc46deceda076d429ef3fab2ccf8d96629ebd23",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "ad93a1f1a45652478c0cf4eb029114e03af57f3b",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "3859f630b674801a00bca39bc451f52288591f65",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "06afe425d5283b9764303de47f554da5a808ce8a",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA AES cipher key requests\n\ncca_cipher2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through an ioctl (PKEY_KBLOB2PROTK2/3) on the /dev/pkey character device, requiring local access to the s390 system; there is no remote or adjacent-network path to cca_cipher2protkey().\nAC:L - The overflow is fully deterministic: the attacker sets the token\u0027s len field to any value up to the 8192-byte ioctl limit and the memcpy into the 512-byte parameter block happens unconditionally, before any crypto card interaction, with no race or unknown state involved.\nPR:L - The pkey misc device is registered with .mode = 0666 and neither pkey_api.c, pkey_base.c nor pkey_cca.c performs any capable()/CAP_* check, so any unprivileged local user can open it and issue the key-to-protkey ioctl.\nUI:N - The attacker triggers the overflow entirely on its own by issuing the ioctl with a crafted CCA AES cipher key token; no victim action or cooperation is needed.\nS:U - The heap corruption occurs in kernel slab memory managed by the same kernel security authority as the calling process; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The controlled slab overflow (up to ~7.6 KB past a kmalloc-2k object) lets the attacker overwrite adjacent kernel objects, and the corrupted CPRB/reply buffer is subsequently parsed and partially copied back to userspace, giving a path to disclosing arbitrary kernel memory.\nI:H - memcpy() writes attacker-chosen token bytes far beyond the 512-byte parameter block, an out-of-bounds heap write with attacker-controlled length and contents, which is a classic primitive for corrupting neighbouring slab objects and hijacking control flow.\nA:H - Overwriting several kilobytes of adjacent slab memory reliably corrupts unrelated kernel objects and slab metadata, causing oopses or a panic; the ioctl can be repeated at will by any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:50.661Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be037204e4f595e4bd2159acda146677a1dc6342"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e500ecb6704d879f9c2417c2ed6faba595015ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f9e5a3dbb14a9b321a1dfa30390402c673f82dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65"
        },
        {
          "url": "https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a"
        }
      ],
      "title": "s390/zcrypt: Validate length for CCA AES cipher key requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68452",
    "datePublished": "2026-08-13T13:59:54.840Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-10-19T21:09:11.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:51:36.934072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:26.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/resctrl/rdtgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b7bb07efe41bb646a93c4624aa2bb35df190342",
              "status": "affected",
              "version": "2a65660385444e9d9deffe995c71ee20443ef76e",
              "versionType": "git"
            },
            {
              "lessThan": "7d330a1d663381579b9d5dafa642b1b3158a0ce2",
              "status": "affected",
              "version": "2a65660385444e9d9deffe995c71ee20443ef76e",
              "versionType": "git"
            },
            {
              "lessThan": "52fce648607e0d6a76eeb443d78708c49df1c554",
              "status": "affected",
              "version": "2a65660385444e9d9deffe995c71ee20443ef76e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/resctrl/rdtgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/resctrl: Fix use-after-free during unmount\n\nDuring unmount or failure teardown all mon_data structures that contain\nmonitoring event file private data are freed after which kernfs nodes are\nremoved. However, the RDT_DELETED flag is never set for the statically\nallocated default resource group.\n\nA concurrent reader of an event file associated with the default resource\ngroup may, after dropping kernfs active protection, block on rdtgroup_mutex\nwhile unmount proceeds to free the file private data and destroy the kernfs\nnode without waiting for the reader.\n\nWhen the mutex is released, the reader wakes up, observes that RDT_DELETED\nis not set for the default group, and dereferences the already-freed\nfile private data.\n\nThe scenario can be depicted as follows:\n  CPU0                                      CPU1\n   /*\n    * Default resource group\u0027s\n    * monitoring data accessible via\n    * kernfs file with kernfs_node::priv\n    * pointing to a struct mon_data.\n    * User opens the file for reading.\n    */\n   rdtgroup_mondata_show()                 /* arch encounters fatal error */\n    rdtgroup_kn_lock_live()                 resctrl_exit()\n     atomic_inc(\u0026rdtgroup_default.waitcount) cpus_read_lock()\n     kernfs_break_active_protection(kn)      mutex_lock(\u0026rdtgroup_mutex)\n     cpus_read_lock()                        resctrl_fs_teardown()\n     mutex_lock(\u0026rdtgroup_mutex)              rmdir_all_sub()\n                                              mon_put_kn_priv()\n                                               /* Delete all mon_data structures */\n                                              rdtgroup_destroy_root()\n                                               kernfs_destroy_root()\n                                               rdtgroup_default.kn = NULL\n                                             mutex_unlock(\u0026rdtgroup_mutex)\n     /*\n      * rdtgroup_default.flags is empty so\n      * rdtgroup_kn_lock_live() returns\n      * \u0026rdtgroup_default\n      */\n     md = of-\u003ekn-\u003epriv;\n\n     /* md points to freed mon_data */\n\nSet RDT_DELETED for the default group unconditionally since the flag does\nnot lead to the freeing of this statically allocated group.\n\nDo not allow a new resctrl mount if there are any waiters on default group\nof previous mount. A new mount will re-initialize the default group that\nwould appear to waiters from previous mount as though the default group is\naccessible causing them to access the mon_data structures from the previous\nmount that have been removed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by a local process reading resctrl monitoring event files under /sys/fs/resctrl via open/read on kernfs; there is no network, Bluetooth, or physical-device entry path to rdtgroup_mondata_show().\nAC:L - This is a race between a reader in rdtgroup_kn_lock_live() and teardown in resctrl_fs_teardown()/resctrl_exit(); an attacker can drive both sides with concurrent threads (read mondata while unmounting or during MPAM-initiated teardown) and retry until the window is hit.\nPR:L - Default-group mondata files are world-readable (0444) once resctrl is mounted; triggering teardown via umount is reachable with CAP_SYS_ADMIN from an unprivileged user namespace, and on ARM MPAM systems resctrl_exit() can run while any local user is reading.\nUI:N - No victim interaction is required; the attacker opens and reads monitoring files and initiates or times concurrent resctrl unmount/teardown themselves to win the race.\nS:U - Exploitation corrupts kernel heap memory and enables local privilege escalation within the same kernel security authority; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Use-after-free of kmalloc\u0027d struct mon_data lets the attacker influence freed object contents; subsequent reads of md-\u003erid, md-\u003edomid, and md-\u003eevt enable arbitrary kernel memory disclosure through mon_event_read().\nI:H - The UAF provides a controllable heap primitive; forged mon_data/evt pointers passed into mon_event_read() and resctrl_arch_mon_ctx_alloc() can be leveraged for arbitrary kernel writes and local code execution.\nA:H - Dereferencing freed mon_data during rdtgroup_mondata_show() can immediately kernel oops/panic the system, and repeated triggering of the race provides a reliable denial-of-service even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:04.208Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b7bb07efe41bb646a93c4624aa2bb35df190342"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d330a1d663381579b9d5dafa642b1b3158a0ce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/52fce648607e0d6a76eeb443d78708c49df1c554"
        }
      ],
      "title": "fs/resctrl: Fix use-after-free during unmount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72080",
    "datePublished": "2026-08-15T05:52:29.827Z",
    "dateReserved": "2026-08-09T03:40:39.904Z",
    "dateUpdated": "2026-10-19T21:19:26.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72221",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:43:57.343257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:45:02.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "e0f4691d42a54d359d8b64509fd9ab938d4f2a33",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "a4f878e8ecd729ccf2e50993444e217583adeace",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "d00e32f84ca1a77cb67a3fbf59f58dada95f5a21",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: wait for in-flight TLS handshake callback when cancel loses race\n\nWhen wait_for_completion_interruptible_timeout() in\nsvc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and\ntls_handshake_cancel() then returns false, handshake_complete() has\nwon the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and\nis about to invoke svc_tcp_handshake_done(), but the callback\u0027s\nside effects on xpt_flags and on svsk-\u003esk_handshake_done have not\nyet committed.\n\nThe current code reads xpt_flags immediately to decide whether the\nsession succeeded. Two races result.\n\nIf the callback has executed set_bit(XPT_TLS_SESSION) but not yet\nclear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,\nenqueues the transport, and returns. svc_xprt_received() then\nclears XPT_BUSY, a worker thread picks the transport up, the\ndispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,\nand xpo_handshake is invoked a second time. That svc_tcp_handshake()\ncalls init_completion(\u0026svsk-\u003esk_handshake_done) while the original\ncallback concurrently calls complete_all() on it, corrupting the\nembedded swait_queue.\n\nIf the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet\nentered svc_tcp_handshake_done(), svc_tcp_handshake() reads\nXPT_TLS_SESSION as clear and tears the connection down even though\nthe handshake is about to succeed.\n\nWait for the callback to commit before inspecting xpt_flags. The\ncompletion is guaranteed to fire because handshake_complete()\ninvokes svc_tcp_handshake_done() unconditionally once it has set\nHANDSHAKE_F_REQ_COMPLETED."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:42.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33"
        },
        {
          "url": "https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace"
        },
        {
          "url": "https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21"
        }
      ],
      "title": "sunrpc: wait for in-flight TLS handshake callback when cancel loses race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72221",
    "datePublished": "2026-08-15T05:54:14.539Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-10-16T18:45:02.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72222",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:44:02.358946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:45:02.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3b55945dd99f29d83e1965d0141040a35262346",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "2d4f97d13fff91e0bc539216be88b884b544d49f",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "3f9ee75a97a769be258784c22b89657acb5ed9bd",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "4f988f3a2808fb659f3880c282041ff067acad78",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: pin svc_xprt across the asynchronous TLS handshake callback\n\nsvc_tcp_handshake() stores the raw svc_xprt pointer in\ntls_handshake_args.ta_data and submits the request through\ntls_server_hello_x509(). The handshake core takes only\nsock_hold(req-\u003ehr_sk); nothing references the embedding struct\nsvc_sock that svc_tcp_handshake_done() reaches via container_of().\n\nTwo close races leave the in-flight callback writing through a freed\nsvc_sock. svc_sock_free() calls tls_handshake_cancel() and discards\nits return value: a false return means handshake_complete() has\nalready set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have\nfinished, yet svc_sock_free() proceeds to kfree(svsk). The\ncancel-loser fall-through inside svc_tcp_handshake() itself produces\nthe same window: when wait_for_completion_interruptible_timeout()\nreturns \u003c= 0 (timeout or signal) and tls_handshake_cancel() returns\nfalse, the function does not drain, returns, and svc_handle_xprt()\ncalls svc_xprt_received(), which clears XPT_BUSY and can drop the\nlast reference. A concurrent close then runs svc_sock_free() while\nsvc_tcp_handshake_done() is still updating xpt_flags and walking\nsvsk-\u003esk_handshake_done.\n\nThe corruption surfaces as set_bit/clear_bit RMW into the freed\nxpt_flags slab slot and as complete_all() walking and writing the\nfreed wait_queue_head_t list embedded in sk_handshake_done -- a\nslab-corruption primitive, not a benign read. The path is reachable\non any TLS-enabled NFS server whenever a connection close overlaps\nthe tlshd downcall delivery window; the interruptible wait means\nsignal delivery suffices, not just SVC_HANDSHAKE_TO expiry.\n\nTake svc_xprt_get(xprt) immediately before tls_server_hello_x509()\nso the in-flight callback owns its own reference. Release it on the\ntwo edges where the callback is guaranteed not to fire -- submission\nfailure from tls_server_hello_x509() and a successful\ntls_handshake_cancel() -- and at the tail of\nsvc_tcp_handshake_done() after complete_all().\n\n[cel: rewrote commit message to describe the actual change]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd\u0027s server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel\u0027s security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:44.196Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78"
        }
      ],
      "title": "sunrpc: pin svc_xprt across the asynchronous TLS handshake callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72222",
    "datePublished": "2026-08-15T05:54:15.277Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-10-16T18:45:02.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:01:22.679570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:58.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0f973bb5118dd1b146cda3fcc8af6f6057befec",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "3b539b317cd052236fed0350364ff1268996ba46",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "db9d8e3b670f841755bc2018f178472dc6064d27",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "31efa656cf6aface26e88f038c14f22ee6ca1500",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "291accf36febce751021888de5f15090f4875b56",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "ca33df36aa0143a1d04f57d2086020c12e7eddb7",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "163847552a571bd55094291f4ffcdc1de0f14a7b",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear new_transport when removing a peer\n\nsctp_process_asconf_param() stores a newly added peer transport in\nasoc-\u003enew_transport. After all parameters in the ASCONF chunk have been\nprocessed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the\nnew transport.\n\nAn authenticated ASCONF from a remote SCTP peer can add a transport and\nremove it again with a wildcard DEL-IP parameter in the same chunk. The\nwildcard deletion preserves the transport on which the ASCONF arrived, but\nremoves the newly added transport through\nsctp_assoc_del_nonprimary_peers(). The removal does not clear\nasoc-\u003enew_transport, leaving it pointing to the removed transport.\n\nsctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u003etransport points\nto the removed transport without holding a transport reference. During\nlocal address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on\ncontrol_chunk_list. After the transport is freed by RCU, a successful\nASCONF_ACK for the replacement address releases the queued HEARTBEAT and\nsctp_outq_select_transport() reads the freed transport\u0027s state.\n\nThe issue was found during a static audit of SCTP objects. With an\nauthenticated peer, the reproducer triggered the same KASAN report in 2\nof 2 unpatched runs on a KASAN-enabled netdev/main kernel:\n\n  BUG: KASAN: slab-use-after-free in sctp_outq_select_transport\n  Read of size 4 at addr ffff88800b9bd95c by task python3/197\n\n  Call Trace:\n   sctp_outq_select_transport+0x549/0x8b0 [sctp]\n   sctp_outq_flush+0x306/0x2c60 [sctp]\n   sctp_transport_immediate_rtx+0xaf/0x260 [sctp]\n   sctp_process_asconf_ack+0xa48/0xf70 [sctp]\n\n  Allocated by task 197:\n   sctp_transport_new+0x68/0x650 [sctp]\n   sctp_assoc_add_peer+0x258/0x12a0 [sctp]\n   sctp_process_asconf+0x5e9/0x1090 [sctp]\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x77/0xb70\n   sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]\n   sctp_process_asconf+0xd9c/0x1090 [sctp]\n\nThe first invalid access was a four-byte read of transport-\u003estate at\nnet/sctp/outqueue.c:833. The same reproducer completed the full\nauthenticated ASCONF and local-address replacement sequence with this\nchange without a KASAN report or oops.\n\nClear new_transport when its peer is removed, before it can be used to\ncreate the HEARTBEAT."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered when a remote SCTP peer sends an authenticated ASCONF chunk that is processed via sctp_rcv() through the state machine into sctp_sf_do_asconf() and sctp_process_asconf(); this is standard network packet handling, not a local syscall or ioctl path.\nAC:L - The remote peer fully controls a single ASCONF containing ADD_IP followed by wildcard DEL-IP to add then remove a transport while leaving asoc-\u003enew_transport dangling; combined with routine SCTP local address replacement (src_out_of_asoc_ok), the KASAN reproducer hit the UAF in 2/2 runs.\nPR:N - Exploitation requires only being an established SCTP association peer sending SCTP-AUTH-protected ASCONF traffic negotiated during the normal handshake (or addip_noauth); no Linux account, capability, or init-namespace privilege is needed on the victim host.\nUI:N - No victim user action such as opening a file or mounting a filesystem is required; the kernel automatically processes attacker-crafted ASCONF packets on an existing SCTP association during normal server operation.\nS:U - Impact is confined to kernel heap corruption on the vulnerable host (slab UAF on sctp_transport) and potential privilege escalation within that kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - KASAN reports slab-use-after-free with a 4-byte read of freed sctp_transport-\u003estate in sctp_outq_select_transport(); UAF on heap transport objects enables grooming for arbitrary kernel memory disclosure per kernel CVSS guidance.\nI:H - The dangling sctp_transport pointer is embedded in a queued HEARTBEAT control chunk without a reference; UAF on this heap object can be leveraged via heap spraying for arbitrary kernel writes and control-flow hijacking, not merely a bounded corruption.\nA:H - Dereferencing the freed transport during sctp_outq_flush() causes a reproducible kernel UAF/oops; remote peers can repeatedly trigger this against SCTP endpoints handling ADD-IP traffic, yielding denial of service or crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:12.552Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0f973bb5118dd1b146cda3fcc8af6f6057befec"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b539b317cd052236fed0350364ff1268996ba46"
        },
        {
          "url": "https://git.kernel.org/stable/c/db9d8e3b670f841755bc2018f178472dc6064d27"
        },
        {
          "url": "https://git.kernel.org/stable/c/31efa656cf6aface26e88f038c14f22ee6ca1500"
        },
        {
          "url": "https://git.kernel.org/stable/c/291accf36febce751021888de5f15090f4875b56"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca33df36aa0143a1d04f57d2086020c12e7eddb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/163847552a571bd55094291f4ffcdc1de0f14a7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3"
        }
      ],
      "title": "sctp: clear new_transport when removing a peer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74586",
    "datePublished": "2026-08-22T15:31:39.094Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-10-16T19:05:58.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:01:29.030905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:59.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/outqueue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6575fb17230814b48b471727c8410c0aadff9274",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6b9e2ea2057113f3393990ba646d2d97c719a80d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "874a7c2b5e184f06134fdfde27e9ce9271bafe58",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1adf929121e13e0b19200bb9fef715b918d483fe",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e2e7c1de0e226ca1b7fea2de57a6c9bca408709b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f2cf069a9a72a2d6b97ca8b4c70e714aac99749",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/outqueue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk-\u003etransport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport\u0027s\ntransmitted list without updating chunk-\u003etransport:\n\n\tif (chunk-\u003etsn_gap_acked) {\n\t\tlist_move_tail(\u0026chunk-\u003etransmitted_list,\n\t\t\t       \u0026transport-\u003etransmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport\u0027s list while chunk-\u003etransport still\nnames a different one.  If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer.  sctp_assoc_rm_peer() scrubs\npeer-\u003etransmitted and asoc-\u003eoutqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set.  A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk-\u003etransport-\u003eflight_size -= sctp_data_size(tchunk);\n\ninside the freed transport.  KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer().  Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk-\u003etransport at the move.  The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when the kernel SCTP stack processes inbound SACK and ASCONF chunks from a remote association peer via sctp_rcv()/sctp_inq_push(), with no local syscall or ioctl required on the victim.\nAC:L - The remote peer controls the SCTP protocol sequence (gap SACKs, ADDIP multihoming, ASCONF Delete-IP, and SACK reneging) needed to strand a chunk and free its transport; no attacker-uncontrollable race or rare memory layout is required.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted SACK and ASCONF packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - KASAN reports a slab use-after-free read through dangling chunk-\u003etransport in sctp_check_transmitted(); UAF on sctp_transport objects can be groomed for arbitrary kernel memory disclosure.\nI:H - The UAF dereference performs flight_size arithmetic on a freed sctp_transport slab object, enabling heap grooming and arbitrary kernel write or control-flow hijack primitives typical of SCTP transport UAFs.\nA:H - Accessing freed transport memory during SACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:15.097Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d"
        },
        {
          "url": "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58"
        },
        {
          "url": "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749"
        }
      ],
      "title": "sctp: keep chunk-\u003etransport in step with the list it is queued on",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74588",
    "datePublished": "2026-08-22T15:31:40.466Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-10-16T19:05:59.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:16:25.350604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:24.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sctp/auth.h",
            "net/sctp/auth.c",
            "net/sctp/sm_make_chunk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a4410de8dc6903d859c9e1731fc6dcee28bd072",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "7f17984cfa697613800eb693e183b06884129bd3",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "88619b117be1daf633ce32210570ce35a0bd1c98",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            },
            {
              "lessThan": "3dbb44d88b1e94dd31fe43588af7437b34b44d56",
              "status": "affected",
              "version": "1f485649f52929d9937b346a920a522a7363e202",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sctp/auth.h",
            "net/sctp/auth.c",
            "net/sctp/sm_make_chunk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes.  A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction.  A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie\u0027s RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association.  Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO to a listening endpoint; packets enter sctp_rcv() and are handled in sctp_sf_do_5_1D_ce()/sctp_unpack_cookie() with no local syscall required on the victim.\nAC:L - With SCTP-AUTH enabled and cookie_hmac_alg=none, an attacker completes INIT/INIT-ACK, forges peer-controlled AUTH fields in the returned cookie, and reliably triggers sctp_auth_make_key_vector()/sctp_auth_calculate_hmac() via COOKIE-ECHO without races or uncontrollable conditions.\nPR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local account privileges, capabilities, or init-namespace root on the target host.\nUI:N - No victim user action is required beyond normal SCTP listener operation; exploitation is achieved solely by sending attacker-crafted COOKIE-ECHO packets over the network during association setup or restart.\nS:U - The vulnerability corrupts kernel memory inside the SCTP stack on the target host and enables kernel privilege escalation; it does not cross a separate security boundary such as guest-to-host VM escape or IOMMU/DMA isolation bypass.\nC:H - A forged RANDOM length copied from an unauthenticated cookie drives sctp_auth_make_key_vector() to memcpy() beyond the fixed auth_random backing array, enabling out-of-bounds kernel memory reads during association shared-key construction.\nI:H - Forged HMAC identifiers from the cookie can yield a zero-length AUTH chunk while sctp_auth_calculate_hmac() still writes a 32-byte digest past the allocation, providing a heap overflow primitive the fix commit notes can chain to local privilege escalation.\nA:H - Out-of-bounds reads and the 32-byte heap overflow during COOKIE-ECHO processing can trigger kernel faults, oops, or panic on SCTP servers, and malformed AUTH state can repeatedly crash association input handling."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:46:23.915Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"
        }
      ],
      "title": "sctp: validate cookie AUTH state before use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74752",
    "datePublished": "2026-08-26T14:36:59.548Z",
    "dateReserved": "2026-08-15T05:44:03.931Z",
    "dateUpdated": "2026-10-21T12:46:23.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}