Vulnerability-Lookup

RHSA-2026:97873

Vulnerability from csaf_redhat - Published: 2026-11-11 01:27 - Updated: 2026-11-11 01:29

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332) * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245) * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488) * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811) * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364) * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466) * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725) * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling (CVE-2026-98974) Bug Fix(es) and Enhancement(s): * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.9.z] (JIRA:RHEL-254109) * Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-9.9] (JIRA:RHEL-174325) * [RHEL-9.9] gfp: include __GFP_NOWARN in GFP_NOWAIT (JIRA:RHEL-249621) * gfs2: Get rid of sd_async_glock_wait [rhel-9.9.z] (JIRA:RHEL-254079) * TLS-related kernel panics in kernel-5.14.0-741.10.1.el9_9 and higher (JIRA:RHEL-283336) * RHEL is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.9.z] (JIRA:RHEL-291353) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-22063

In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket, but the connect function is called with an IPv6 address, the function calipso_sock_setattr() is triggered. Inside this function, the following code is executed: sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL; Since sk is an IPv4 socket, pinet6 is NULL, leading to a null pointer dereference. This patch fixes the issue by checking if inet6_sk(sk) returns a NULL pointer before accessing pinet6.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 360 products

Product	Version	Remediation
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debug-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debug-devel-matched-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-devel-matched-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-ppc64le-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-s390x-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-doc-0:5.14.0-741.20.1.el9_9.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-zfcpdump-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-zfcpdump-devel-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-zfcpdump-devel-matched-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.20.1.el9_9.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-abi-stablelists-0:5.14.0-741.20.1.el9_9.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-uki-virt-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-ppc64le-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-s390x-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-libs-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-libs-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-libs-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-uki-virt-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-uki-virt-addons-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-core-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-modules-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-modules-core-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-modules-extra-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-ppc64le-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-s390x-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-libs-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-libs-devel-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-libs-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-zfcpdump-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: NFV-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.20.1.el9_9.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-38004

A flaw was found in the Linux kernel's Controller Area Network (CAN) broadcast manager (BCM). Improper locking during runtime updates of internal counters in the bcm_can_tx() function allows a local attacker to trigger a slab-out-of-bounds read access. This vulnerability can lead to information disclosure or a denial of service (DoS) condition, potentially compromising system stability or sensitive data.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2025-38147

In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598 __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088 __do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in:

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-43332

A flaw was found in the Linux kernel's thermal core subsystem. When `thermal_zone_device_register_with_trips()` fails during device registration, it does not properly wait for the thermal zone device's removal completion. This can lead to the premature freeing of the device's memory, creating a use-after-free vulnerability. A local attacker could potentially exploit this to cause a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-53365

A flaw was found in the Linux kernel's `vsock/virtio` component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers (skbs). An issue in how user arguments (uargs) are handled for these buffers can lead to pinned user pages not being properly tracked or released. This prevents the kernel from notifying userspace when these memory pages are safe to reuse, potentially leading to memory leaks or data corruption if pages are prematurely reallocated. This issue could lead to local privilege escalation.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-63899

A flaw was found in the Linux kernel's USB serial mxuport driver. A malicious Universal Serial Bus (USB) device could exploit this vulnerability by reporting a bulk-out endpoint maximum packet size smaller than eight bytes. This can lead to user-controlled slab corruption, potentially allowing an attacker to achieve arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-63962

A flaw was found in the Linux kernel's USB Type-C Port Manager (TCPM) driver. A remote attacker, acting as a malicious USB-C port partner, could exploit an out-of-bounds write vulnerability in the svdm_consume_modes() function. By sending an unsolicited 'Discover Modes ACK' with excessive data, the attacker can cause memory corruption. This could lead to a denial of service or potentially arbitrary code execution on the affected system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-63970

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers (skbs) and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a use-after-free condition or memory corruption. This can potentially allow a local attacker to cause a denial of service or escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-64018

A flaw was found in the Linux kernel's mana network driver. In Confidential Virtual Machines (VMs), a missing bounds check when processing network events can allow a malicious hardware component or a compromised VM to write data outside of an intended memory region. This out-of-bounds access could lead to system instability or a denial of service.

8.7 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-64034

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use (TOCTOU) vulnerability allows a hardware component to modify a message identifier (hwc_msg_id) in Direct Memory Access (DMA) memory after it has been validated but before it is used. This manipulation bypasses critical bounds validation, potentially leading to unexpected system behavior or security bypasses, particularly in Confidential Virtual Machines (CVMs) where DMA memory is shared and unencrypted.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-64035

A flaw was found in the Linux kernel's igc network driver. The `igc_fpe_init_smd_frame()` function, responsible for initializing transmit (TX) buffer fields for Stream-based Data (SMD) frames, does not correctly set the buffer type. This can result in stale XDP (eXpress Data Path) or XSK (AF_XDP socket) types persisting in reused TX buffer entries. Consequently, the system's TX completion process may follow an incorrect cleanup path, potentially leading to memory corruption or system instability.

4.8 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-64162

A flaw was found in the Linux kernel's Intel Ethernet controller driver (idpf). This vulnerability occurs because a critical synchronization mechanism, known as a spinlock, is accessed before it has been properly initialized. An attacker could potentially exploit this timing issue to cause the system to become unstable or crash, leading to a Denial of Service (DoS).

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-909 - Missing Initialization of Resource

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-64266

A flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) component. The `fuse_ref_folio()` function does not properly re-lock a request after unlocking it, which can lead to a use-after-free vulnerability. A local attacker could exploit this flaw to potentially execute arbitrary code or cause a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-64268

A flaw was found in the Linux kernel's Soft iWARP (siw) driver. A remote attacker, by sending specially crafted Read Response segments that exceed the requested length, can trigger an out-of-bounds write. This vulnerability can lead to memory corruption, potentially causing a kernel crash or privilege escalation.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-64378

A flaw was found in the Linux kernel. A race condition exists between the `cgroup_writeback_umount()` and `inode_switch_wbs()` functions when a container exits. This race can lead to a kernel panic, resulting in a denial of service. This vulnerability could be triggered by a local user by exiting a container.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-64481

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can lead to a worker attempting to access driver data that is no longer valid after teardown, resulting in memory corruption. An attacker with local access could potentially exploit this to cause a denial of service or escalate privileges.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-68202

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed, leading to a use-after-free vulnerability. This can result in a system crash (denial of service) or potentially lead to arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-68236

A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the `dm_update_crtc_state()` function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a use-after-free vulnerability. This issue could potentially lead to memory corruption or a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-68245

A flaw was found in the `drm/amdgpu` component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine (VM) pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker could exploit this to cause a denial of service or achieve privilege escalation.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-68278

A flaw was found in the Linux kernel's DisplayPort (DP) Multi-Stream Transport (MST) subsystem. This vulnerability involves multiple buffer overflows within the `drm_dp_sideband_append_payload()` function when handling data from connected devices. A physically connected, malicious DP MST device can exploit this by sending specially crafted messages, leading to memory corruption. This could potentially allow an attacker to cause system instability or execute unauthorized code.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-120 - Buffer Copy without Checking Size of Input

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-68293

A flaw was found in the `net/mlx5` driver of the Linux kernel. When the driver attempts to read the MCIA register from a device advertising the `mcia_32dwords` capability, the `mlx5_query_mcia()` function can read more data than the allocated buffer can hold. This leads to a buffer overflow, which can cause a kernel bug and result in a system crash, leading to a Denial of Service (DoS).

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-68299

A flaw was found in the `vmxnet3` virtual network device driver within the Linux kernel. When processing Geneve-encapsulated packets, the `vmxnet3_get_hdr_len()` function can incorrectly interpret header information, leading to a mismatch between expected and actual packet protocols or IP versions. This can trigger a `BUG_ON` condition, resulting in a kernel panic and a system crash, effectively causing a Denial of Service (DoS).

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-72083

A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the `core_scsi3_emulate_pro_register_and_move()` function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spans multiple pages. An attacker could potentially exploit this to cause a system crash, leading to a denial of service.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-72289

A flaw was found in the KVM (Kernel-based Virtual Machine) arm64 vgic (Virtual Generic Interrupt Controller) component of the Linux kernel. During interrupt migration, the vgic_prune_ap_list() function temporarily drops and reacquires locks. If an interrupt is removed from the active processor list (ap_list) during this unlocked period, a subsequent check for interrupt affinity may still pass, leading to a double deletion of the interrupt from the list. This double free-like condition could potentially lead to system instability or denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-72319

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. This vulnerability occurs when the system processes Internet Control Message Protocol (ICMP) errors originating from network tunnels. Specifically, after stripping outer packet headers, the IPVS component fails to ensure that the inner IP headers are correctly positioned in the packet buffer's headroom. This improper handling of network packet headers could lead to incorrect packet processing, potentially resulting in a denial of service (DoS) or other forms of network instability.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-74705

A flaw was found in the Linux kernel's UDP (User Datagram Protocol) tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the __skb_udp_tunnel_segment() function. An attacker could potentially exploit a use-after-free condition, where the system attempts to use memory that has already been released, leading to system instability or potentially arbitrary code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-80536

A flaw was found in the Linux kernel's XFS filesystem. A local attacker, by mounting a specially crafted XFS image, could trigger an out-of-bounds write during log recovery. This vulnerability allows for kernel heap corruption, which could lead to a denial of service or potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-80887

A flaw was found in the `drm/vmwgfx` component of the Linux kernel. An integer overflow vulnerability exists in the `vmw_shader_define()` function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-80985

A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access (SMC-Rv2) protocol implementation. The `smc_llc_rmt_delete_rkey()` and `smc_llc_save_add_link_rkeys()` functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to the processing of stale or unintended data from previous messages, potentially resulting in information disclosure or data corruption. A remote attacker could exploit this vulnerability to gain access to sensitive information or cause system instability.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated memory buffer. Consequently, sensitive information from kernel memory may be exposed to a local user through the `/proc/fs/cifs/DebugData` interface.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-89777

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial of service, or potentially execute arbitrary code with elevated privileges.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-89811

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler (MES) fails to perform a necessary Translation Lookaside Buffer (TLB) invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access (DMA) descriptors to access memory that has already been unmapped, leading to page faults and potential GPU queue hangs, particularly during Shared Virtual Memory (SVM) page migration.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-90011

A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol (CHAP). This can lead to an out-of-bounds read, potentially resulting in information disclosure from adjacent memory or a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-93817

A flaw was found in the Linux kernel's performance events (perf) subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performance monitoring operations to cause a Denial of Service (DoS) through a system crash or potentially corrupt system memory.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-93827

A flaw was found in the Linux kernel's virtio-fs file system driver. When queue initialization fails—such as when a device advertises more request queues than supported—the driver fails to clear memory pointers after releasing them, resulting in a double-free condition during error cleanup. An attacker capable of presenting a malformed virtio-fs device can exploit this flaw to cause memory corruption, leading to a system crash and Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-98260

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigger a use-after-free condition, leading to a system crash and Denial of Service (DoS) or potential privilege escalation.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-98320

A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Moderate

CVE-2026-98466

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages. A privileged local host can exploit this flaw to inspect or alter sensitive hypervisor stack data, resulting in a bypass of hypervisor isolation and potential privilege escalation.

8.2 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE-653 - Improper Isolation or Compartmentalization

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

CVE-2026-98725

A flaw was found in the Linux kernel's NVMe over Fabrics (NVMe-oF) target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service (DoS) through a system crash or potential memory corruption. This issue occurs due to an incorrect buffer size calculation during authentication challenge processing, which allows an undersized buffer to bypass validation checks and results in an out-of-bounds write.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2025-22063

Threats

Impact Important

References

261 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:97873	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2360273	external
https://bugzilla.redhat.com/show_bug.cgi?id=2370992	external
https://bugzilla.redhat.com/show_bug.cgi?id=2376106	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468043	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492108	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492741	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492851	external
https://bugzilla.redhat.com/show_bug.cgi?id=2499742	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502325	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502332	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502356	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502394	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502411	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502421	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502476	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502521	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502593	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507038	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507089	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507098	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507222	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507296	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513148	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513150	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513245	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513277	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513287	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513356	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513430	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516579	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516657	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516935	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516967	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516970	external
https://bugzilla.redhat.com/show_bug.cgi?id=2517006	external
https://bugzilla.redhat.com/show_bug.cgi?id=2521498	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524492	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524501	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528788	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532089	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532279	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532407	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532493	external
https://bugzilla.redhat.com/show_bug.cgi?id=2535066	external
https://bugzilla.redhat.com/show_bug.cgi?id=2535227	external
https://bugzilla.redhat.com/show_bug.cgi?id=2535309	external
https://bugzilla.redhat.com/show_bug.cgi?id=2536264	external
https://bugzilla.redhat.com/show_bug.cgi?id=2540391	external
https://bugzilla.redhat.com/show_bug.cgi?id=2540396	external
https://bugzilla.redhat.com/show_bug.cgi?id=2540872	external
https://bugzilla.redhat.com/show_bug.cgi?id=2546487	external
https://bugzilla.redhat.com/show_bug.cgi?id=2546491	external
https://bugzilla.redhat.com/show_bug.cgi?id=2546494	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553390	external
https://bugzilla.redhat.com/show_bug.cgi?id=2554835	external
https://bugzilla.redhat.com/show_bug.cgi?id=2555068	external
https://bugzilla.redhat.com/show_bug.cgi?id=2559811	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-22063	self
https://bugzilla.redhat.com/show_bug.cgi?id=2360273	external
https://www.cve.org/CVERecord?id=CVE-2025-22063	external
https://nvd.nist.gov/vuln/detail/CVE-2025-22063	external
https://lore.kernel.org/linux-cve-announce/202504…	external
https://access.redhat.com/security/cve/CVE-2025-38004	self
https://bugzilla.redhat.com/show_bug.cgi?id=2370992	external
https://www.cve.org/CVERecord?id=CVE-2025-38004	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38004	external
https://lore.kernel.org/linux-cve-announce/202506…	external
https://access.redhat.com/security/cve/CVE-2025-38147	self
https://bugzilla.redhat.com/show_bug.cgi?id=2376106	external
https://www.cve.org/CVERecord?id=CVE-2025-38147	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38147	external
https://lore.kernel.org/linux-cve-announce/202507…	external
https://access.redhat.com/security/cve/CVE-2026-43332	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468043	external
https://www.cve.org/CVERecord?id=CVE-2026-43332	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43332	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-53365	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499742	external
https://www.cve.org/CVERecord?id=CVE-2026-53365	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53365	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63899	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502325	external
https://www.cve.org/CVERecord?id=CVE-2026-63899	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63899	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63962	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502356	external
https://www.cve.org/CVERecord?id=CVE-2026-63962	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63962	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63970	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502411	external
https://www.cve.org/CVERecord?id=CVE-2026-63970	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63970	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64018	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502421	external
https://www.cve.org/CVERecord?id=CVE-2026-64018	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64018	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64034	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502394	external
https://www.cve.org/CVERecord?id=CVE-2026-64034	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64034	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64035	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502476	external
https://www.cve.org/CVERecord?id=CVE-2026-64035	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64035	external
https://kernelcve.org/list/?q=CVE-2026-64035	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64162	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502521	external
https://www.cve.org/CVERecord?id=CVE-2026-64162	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64162	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64266	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507098	external
https://www.cve.org/CVERecord?id=CVE-2026-64266	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64266	external
https://kernelcve.org/list/?q=CVE-2026-64266	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64268	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507089	external
https://www.cve.org/CVERecord?id=CVE-2026-64268	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64268	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64378	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507296	external
https://www.cve.org/CVERecord?id=CVE-2026-64378	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64378	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64481	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507038	external
https://www.cve.org/CVERecord?id=CVE-2026-64481	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64481	external
https://kernelcve.org/list/?q=CVE-2026-64481	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-68202	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513245	external
https://www.cve.org/CVERecord?id=CVE-2026-68202	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68202	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68236	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513148	external
https://www.cve.org/CVERecord?id=CVE-2026-68236	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68236	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68245	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513430	external
https://www.cve.org/CVERecord?id=CVE-2026-68245	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68245	external
https://kernelcve.org/list/?q=CVE-2026-68245	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68278	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513287	external
https://www.cve.org/CVERecord?id=CVE-2026-68278	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68278	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68293	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513150	external
https://www.cve.org/CVERecord?id=CVE-2026-68293	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68293	external
https://kernelcve.org/list/?q=CVE-2026-68293	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68299	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513356	external
https://www.cve.org/CVERecord?id=CVE-2026-68299	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68299	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72083	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516579	external
https://www.cve.org/CVERecord?id=CVE-2026-72083	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72083	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72289	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516657	external
https://www.cve.org/CVERecord?id=CVE-2026-72289	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72289	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72319	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516474	external
https://www.cve.org/CVERecord?id=CVE-2026-72319	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72319	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-74705	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521498	external
https://www.cve.org/CVERecord?id=CVE-2026-74705	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74705	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-80536	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524501	external
https://www.cve.org/CVERecord?id=CVE-2026-80536	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80536	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80887	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528788	external
https://www.cve.org/CVERecord?id=CVE-2026-80887	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80887	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-80985	self
https://bugzilla.redhat.com/show_bug.cgi?id=2532279	external
https://www.cve.org/CVERecord?id=CVE-2026-80985	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80985	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-89631	self
https://bugzilla.redhat.com/show_bug.cgi?id=2532089	external
https://www.cve.org/CVERecord?id=CVE-2026-89631	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89631	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-89777	self
https://bugzilla.redhat.com/show_bug.cgi?id=2535066	external
https://www.cve.org/CVERecord?id=CVE-2026-89777	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89777	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-89811	self
https://bugzilla.redhat.com/show_bug.cgi?id=2535309	external
https://www.cve.org/CVERecord?id=CVE-2026-89811	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89811	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-90011	self
https://bugzilla.redhat.com/show_bug.cgi?id=2535227	external
https://www.cve.org/CVERecord?id=CVE-2026-90011	external
https://nvd.nist.gov/vuln/detail/CVE-2026-90011	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-93817	self
https://bugzilla.redhat.com/show_bug.cgi?id=2540391	external
https://www.cve.org/CVERecord?id=CVE-2026-93817	external
https://nvd.nist.gov/vuln/detail/CVE-2026-93817	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-93827	self
https://bugzilla.redhat.com/show_bug.cgi?id=2540396	external
https://www.cve.org/CVERecord?id=CVE-2026-93827	external
https://nvd.nist.gov/vuln/detail/CVE-2026-93827	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://kernelcve.org/list/?q=CVE-2026-93827	external
https://access.redhat.com/security/cve/CVE-2026-98260	self
https://bugzilla.redhat.com/show_bug.cgi?id=2546491	external
https://www.cve.org/CVERecord?id=CVE-2026-98260	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98260	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98320	self
https://bugzilla.redhat.com/show_bug.cgi?id=2546494	external
https://www.cve.org/CVERecord?id=CVE-2026-98320	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98320	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98466	self
https://bugzilla.redhat.com/show_bug.cgi?id=2554835	external
https://www.cve.org/CVERecord?id=CVE-2026-98466	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98466	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98725	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555068	external
https://www.cve.org/CVERecord?id=CVE-2026-98725	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98725	external
https://git.kernel.org/pub/scm/linux/security/vul…	external

JSON

To clipboard

Loading 4.8 MB of JSON…

CVE-2025-22063 (GCVE-0-2025-22063)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-05-11 21:11

Title

netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 17:40 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/1ad9166cab6a0f5c0…
https://git.kernel.org/stable/c/1e38f7a6cdd68377f…
https://git.kernel.org/stable/c/a7e89541d05b98c79…
https://git.kernel.org/stable/c/797e5371cf55463b4…
https://git.kernel.org/stable/c/1927d0bcd5b81e809…
https://git.kernel.org/stable/c/3ba9cf69de50e8abe…
https://git.kernel.org/stable/c/9fe3839588db75190…
https://git.kernel.org/stable/c/172a8a996a3372069…
https://git.kernel.org/stable/c/078aabd567de3d63d…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < a7e89541d05b98c79a51c0f95df020f8e82b62ed (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 797e5371cf55463b4530bab3fef5f27f7c6657a8 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 1927d0bcd5b81e80971bf6b8eba267508bd1c78b (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 3ba9cf69de50e8abed32b448616c313baa4c5712 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 9fe3839588db7519030377b7dee3f165e654f6c5 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 172a8a996a337206970467e871dd995ac07640b1 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 078aabd567de3d63d37d7673f714e309d369e6e2 (git)
Linux	Linux	Affected: 4.8 Unaffected: 0 , < 4.8 (semver) Unaffected: 5.4.292 , ≤ 5.4.* (semver) Unaffected: 5.10.236 , ≤ 5.10.* (semver) Unaffected: 5.15.180 , ≤ 5.15.* (semver) Unaffected: 6.1.134 , ≤ 6.1.* (semver) Unaffected: 6.6.87 , ≤ 6.6.* (semver) Unaffected: 6.12.23 , ≤ 6.12.* (semver) Unaffected: 6.13.11 , ≤ 6.13.* (semver) Unaffected: 6.14.2 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22063",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:40:57.902233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:41:00.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:48.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/calipso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "a7e89541d05b98c79a51c0f95df020f8e82b62ed",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "797e5371cf55463b4530bab3fef5f27f7c6657a8",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "1927d0bcd5b81e80971bf6b8eba267508bd1c78b",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "3ba9cf69de50e8abed32b448616c313baa4c5712",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "9fe3839588db7519030377b7dee3f165e654f6c5",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "172a8a996a337206970467e871dd995ac07640b1",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "078aabd567de3d63d37d7673f714e309d369e6e2",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/calipso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets\n\nWhen calling netlbl_conn_setattr(), addr-\u003esa_family is used\nto determine the function behavior. If sk is an IPv4 socket,\nbut the connect function is called with an IPv6 address,\nthe function calipso_sock_setattr() is triggered.\nInside this function, the following code is executed:\n\nsk_fullsock(__sk) ? inet_sk(__sk)-\u003epinet6 : NULL;\n\nSince sk is an IPv4 socket, pinet6 is NULL, leading to a\nnull pointer dereference.\n\nThis patch fixes the issue by checking if inet6_sk(sk)\nreturns a NULL pointer before accessing pinet6."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:11:55.405Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7e89541d05b98c79a51c0f95df020f8e82b62ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/797e5371cf55463b4530bab3fef5f27f7c6657a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1927d0bcd5b81e80971bf6b8eba267508bd1c78b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ba9cf69de50e8abed32b448616c313baa4c5712"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe3839588db7519030377b7dee3f165e654f6c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/172a8a996a337206970467e871dd995ac07640b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/078aabd567de3d63d37d7673f714e309d369e6e2"
        }
      ],
      "title": "netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22063",
    "datePublished": "2025-04-16T14:12:18.222Z",
    "dateReserved": "2024-12-29T08:45:45.813Z",
    "dateUpdated": "2026-05-11T21:11:55.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38004 (GCVE-0-2025-38004)

Vulnerability from cvelistv5 – Published: 2025-06-08 10:34 – Updated: 2026-10-15 21:52

Title

can: bcm: add locking for bcm_op runtime updates

Summary

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe' counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh. At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this variable can be modified from both contexts too.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:46 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/8f1c022541bf5a923…
https://git.kernel.org/stable/c/7595de7bc56e0e52b…
https://git.kernel.org/stable/c/fbd8fdc2b218e979c…
https://git.kernel.org/stable/c/2a437b86ac5a9893c…
https://git.kernel.org/stable/c/76c84c3728178b2d3…
https://git.kernel.org/stable/c/cc55dd28c20a6611e…
https://git.kernel.org/stable/c/c4e8a172501e677eb…
https://git.kernel.org/stable/c/c2aba69d0c36a496a…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 8f1c022541bf5a923c8d6fa483112c15250f30a4 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 7595de7bc56e0e52b74e56c90f7e247bf626d628 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < fbd8fdc2b218e979cfe422b139b8f74c12419d1f (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 2a437b86ac5a9893c902f30ef66815bf13587bf6 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 76c84c3728178b2d38d5604e399dfe8b0752645e (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < cc55dd28c20a6611e30596019b3b2f636819a4c0 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < c4e8a172501e677ebd8ea9d9161d97dc4df56fbd (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.4.294 , ≤ 5.4.* (semver) Unaffected: 5.10.238 , ≤ 5.10.* (semver) Unaffected: 5.15.185 , ≤ 5.15.* (semver) Unaffected: 6.1.141 , ≤ 6.1.* (semver) Unaffected: 6.6.93 , ≤ 6.6.* (semver) Unaffected: 6.12.31 , ≤ 6.12.* (semver) Unaffected: 6.14.9 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:33:04.853Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38004",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:46:49.346053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:52:06.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/bcm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f1c022541bf5a923c8d6fa483112c15250f30a4",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "7595de7bc56e0e52b74e56c90f7e247bf626d628",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "2a437b86ac5a9893c902f30ef66815bf13587bf6",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "76c84c3728178b2d38d5604e399dfe8b0752645e",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "cc55dd28c20a6611e30596019b3b2f636819a4c0",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            },
            {
              "lessThan": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
              "status": "affected",
              "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/bcm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.185",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.141",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the \u0027currframe\u0027 counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of \u0027currframe\u0027\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the \u0027count\u0027 variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local `socket(PF_CAN, SOCK_DGRAM, CAN_BCM)` and concurrent `sendmsg()` calls; the race is between the local socket\u0027s user context and the local hrtimer softirq, with no remote input involved.\nAC:L - The attacker controls both sides of the race \u2014 arming the hrtimer with a 1 \u00b5s `ival` (allowed by `bcm_is_invalid_tv()`) to spin `bcm_can_tx()` in softirq while looping `TX_SETUP|TX_ANNOUNCE` sendmsg on another CPU; a working PoC was written and tested by the reporter.\nPR:L - `can_create()` performs no capability check and `can-bcm` is module-autoloaded on socket creation, so any unprivileged local user can reach `bcm_tx_setup()`; the required CAN netdev exists by default on automotive/industrial targets and is otherwise creatable via `unshare -Urn` plus vcan.\nUI:N - The attacker triggers the entire sequence from its own process \u2014 socket creation, timer arming, and the concurrent TX_SETUP updates \u2014 with no victim action required.\nS:U - The out-of-bounds read, the leaked pointers, and the counter underflow are all confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The OOB read is not merely detected by KASAN \u2014 the stale-heap bytes are copied into an skb and looped back by `can_send(skb, 1)`, so up to 72 bytes of adjacent slab memory per iteration, including the `op-\u003esk` and `op-\u003erx_reg_dev` kernel pointers, are delivered to a userspace `CAN_RAW` socket, giving a repeatable heap/KASLR disclosure primitive.\nI:L - No out-of-bounds write primitive exists (`currframe` is only a read index), but the unsynchronized `op-\u003ecount--` from both contexts corrupts kernel state by underflowing the u32 counter, and `op-\u003ecurrframe` itself is left in an invalid out-of-range state, causing the kernel to emit frames it was never instructed to send.\nA:H - The `op-\u003ecount` underflow to 0xFFFFFFFF makes `bcm_tx_set_expiry()` re-arm indefinitely at a 1 \u00b5s interval, producing a persistent softirq/TX flood that starves the CPU, and the slab-out-of-bounds access panics KASAN/hardened kernels outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:55.616Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7"
        }
      ],
      "title": "can: bcm: add locking for bcm_op runtime updates",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38004",
    "datePublished": "2025-06-08T10:34:56.484Z",
    "dateReserved": "2025-04-16T04:51:23.977Z",
    "dateUpdated": "2026-10-15T21:52:06.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38147 (GCVE-0-2025-38147)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-11-05 20:52

Title

calipso: Don't call calipso functions for AF_INET sk.

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 20:50 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/fc2da88411470480b…
https://git.kernel.org/stable/c/0c813dbc851dbf418…
https://git.kernel.org/stable/c/26ce90f1ce60b0ff5…
https://git.kernel.org/stable/c/c32ebe33626335a53…
https://git.kernel.org/stable/c/946bfdfcb76ac2bac…
https://git.kernel.org/stable/c/dd8928897594931d6…
https://git.kernel.org/stable/c/e2ec310c7a5027184…
https://git.kernel.org/stable/c/6e9f2df1c550ead7c…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < fc2da88411470480b8b7e9177e930cedd893cf56 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 0c813dbc851dbf418fdc6dc883fd0592d6c555cd (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 26ce90f1ce60b0ff587de8d6aec399aa55cab28e (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < c32ebe33626335a536dbbdd09571c06dd9bc1729 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 946bfdfcb76ac2bac5b8526447035885ff41c598 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < dd8928897594931d6912ef2f7a43e110b4958d3d (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < e2ec310c7a50271843c585e27ef14e48c66ce649 (git) Affected: ceba1832b1b2da0149c51de62a847c00bca1677a , < 6e9f2df1c550ead7cecb3e450af1105735020c92 (git)
Linux	Linux	Affected: 4.8 Unaffected: 0 , < 4.8 (semver) Unaffected: 5.4.295 , ≤ 5.4.* (semver) Unaffected: 5.10.239 , ≤ 5.10.* (semver) Unaffected: 5.15.186 , ≤ 5.15.* (semver) Unaffected: 6.1.142 , ≤ 6.1.* (semver) Unaffected: 6.6.94 , ≤ 6.6.* (semver) Unaffected: 6.12.34 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:39.593Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38147",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:50:27.165881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:52:17.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netlabel/netlabel_kapi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc2da88411470480b8b7e9177e930cedd893cf56",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "0c813dbc851dbf418fdc6dc883fd0592d6c555cd",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "26ce90f1ce60b0ff587de8d6aec399aa55cab28e",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "c32ebe33626335a536dbbdd09571c06dd9bc1729",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "946bfdfcb76ac2bac5b8526447035885ff41c598",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "dd8928897594931d6912ef2f7a43e110b4958d3d",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "e2ec310c7a50271843c585e27ef14e48c66ce649",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            },
            {
              "lessThan": "6e9f2df1c550ead7cecb3e450af1105735020c92",
              "status": "affected",
              "version": "ceba1832b1b2da0149c51de62a847c00bca1677a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netlabel/netlabel_kapi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: Don\u0027t call calipso functions for AF_INET sk.\n\nsyzkaller reported a null-ptr-deref in txopt_get(). [0]\n\nThe offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo,\nso struct ipv6_pinfo was NULL there.\n\nHowever, this never happens for IPv6 sockets as inet_sk(sk)-\u003epinet6\nis always set in inet6_create(), meaning the socket was not IPv6 one.\n\nThe root cause is missing validation in netlbl_conn_setattr().\n\nnetlbl_conn_setattr() switches branches based on struct\nsockaddr.sa_family, which is passed from userspace.  However,\nnetlbl_conn_setattr() does not check if the address family matches\nthe socket.\n\nThe syzkaller must have called connect() for an IPv6 address on\nan IPv4 socket.\n\nWe have a proper validation in tcp_v[46]_connect(), but\nsecurity_socket_connect() is called in the earlier stage.\n\nLet\u0027s copy the validation to netlbl_conn_setattr().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]\nCPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:txopt_get include/net/ipv6.h:390 [inline]\nRIP: 0010:\nCode: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00\nRSP: 0018:ffff88811b8afc48 EFLAGS: 00010212\nRAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c\nRDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070\nRBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e\nR10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00\nR13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80\nFS:  00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0\nPKRU: 80000000\nCall Trace:\n \u003cTASK\u003e\n calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557\n netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177\n selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569\n selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline]\n selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615\n selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931\n security_socket_connect+0x50/0xa0 security/security.c:4598\n __sys_connect_file+0xa4/0x190 net/socket.c:2067\n __sys_connect+0x12c/0x170 net/socket.c:2088\n __do_sys_connect net/socket.c:2098 [inline]\n __se_sys_connect net/socket.c:2095 [inline]\n __x64_sys_connect+0x73/0xb0 net/socket.c:2095\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f901b61a12d\nCode: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d\nRDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003\nRBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000\n \u003c/TASK\u003e\nModules linked in:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:22:10.226Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc2da88411470480b8b7e9177e930cedd893cf56"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c813dbc851dbf418fdc6dc883fd0592d6c555cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/26ce90f1ce60b0ff587de8d6aec399aa55cab28e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c32ebe33626335a536dbbdd09571c06dd9bc1729"
        },
        {
          "url": "https://git.kernel.org/stable/c/946bfdfcb76ac2bac5b8526447035885ff41c598"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd8928897594931d6912ef2f7a43e110b4958d3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ec310c7a50271843c585e27ef14e48c66ce649"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e9f2df1c550ead7cecb3e450af1105735020c92"
        }
      ],
      "title": "calipso: Don\u0027t call calipso functions for AF_INET sk.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38147",
    "datePublished": "2025-07-03T08:35:52.921Z",
    "dateReserved": "2025-04-16T04:51:23.988Z",
    "dateUpdated": "2026-11-05T20:52:17.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43332 (GCVE-0-2026-43332)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:31 – Updated: 2026-10-19 19:16

Title

thermal: core: Fix thermal zone device registration error path

Summary

In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal completion like thermal_zone_device_unregister(), in case user space has managed to take a reference to the thermal zone device's kobject, in which case thermal_release() may not be called by the error path itself and tz may be freed prematurely. Add the missing wait_for_completion() call to the thermal zone device registration error path.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:16 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/9e796001af97a1f73…
https://git.kernel.org/stable/c/604da9c04c218362e…
https://git.kernel.org/stable/c/c4c7219e93319bba9…
https://git.kernel.org/stable/c/4d390f0e507dfb16d…
https://git.kernel.org/stable/c/9e07e3b81807edd35…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 335176dd8ebaca6493807dceea33c478305667fa , < 9e796001af97a1f7368d5114b7a8533dd98d797a (git) Affected: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea , < 604da9c04c218362e1c1457304ebeb9c199d537c (git) Affected: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea , < c4c7219e93319bba9ba0765dee597784c78f63c5 (git) Affected: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea , < 4d390f0e507dfb16d58f83a58d78d1150dc8b9d7 (git) Affected: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea , < 9e07e3b81807edd356e1f794cffa00a428eff443 (git) Affected: 02871710b93058eb1249d5847c0b2d1c2c3c98ae (git) Affected: 6.6.14 , < 6.6.134 (semver) Affected: 6.7.2 , < 6.8 (semver)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43332",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:16:27.233039Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:16:26.610Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e796001af97a1f7368d5114b7a8533dd98d797a",
              "status": "affected",
              "version": "335176dd8ebaca6493807dceea33c478305667fa",
              "versionType": "git"
            },
            {
              "lessThan": "604da9c04c218362e1c1457304ebeb9c199d537c",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "lessThan": "c4c7219e93319bba9ba0765dee597784c78f63c5",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "lessThan": "4d390f0e507dfb16d58f83a58d78d1150dc8b9d7",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "lessThan": "9e07e3b81807edd356e1f794cffa00a428eff443",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "02871710b93058eb1249d5847c0b2d1c2c3c98ae",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.134",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Fix thermal zone device registration error path\n\nIf thermal_zone_device_register_with_trips() fails after registering\na thermal zone device, it needs to wait for the tz-\u003eremoval completion\nlike thermal_zone_device_unregister(), in case user space has managed\nto take a reference to the thermal zone device\u0027s kobject, in which case\nthermal_release() may not be called by the error path itself and tz may\nbe freed prematurely.\n\nAdd the missing wait_for_completion() call to the thermal zone device\nregistration error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is thermal zone registration/error handling exposed through local kernel device/sysfs activity, not through remote packets or an adjacent/physical protocol.\nAC:L - The race is between local userspace taking a sysfs/kobject reference and the registration error path dropping the device reference; a local attacker can influence the reference side and resource pressure, so under the overestimate rule this is low complexity.\nPR:L - No capability is needed to take references to readable thermal sysfs objects, and a basic local user can race that exposure; root-only debugfs testing paths also exist, but the higher-severity defensible metric is low privileges.\nUI:N - Exploitation does not require a separate victim to open a file or mount anything; the attacker can run local code to monitor/open the thermal sysfs object during registration failure.\nS:U - The corrupted object is in the kernel thermal core and impacts the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossing.\nC:H - The missing wait can free the thermal zone while a kobject reference keeps release deferred, producing a use-after-free on a kernel object; such memory corruption can be leveraged for kernel memory disclosure.\nI:H - The delayed release path dereferences and frees fields from the prematurely freed thermal zone, giving exploitable heap corruption/use-after-free conditions that can support arbitrary modification or code execution.\nA:H - Even without full exploitation, the use-after-free in the device release path can cause kernel oops/panic or heap corruption, resulting in high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:17.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e796001af97a1f7368d5114b7a8533dd98d797a"
        },
        {
          "url": "https://git.kernel.org/stable/c/604da9c04c218362e1c1457304ebeb9c199d537c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4c7219e93319bba9ba0765dee597784c78f63c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d390f0e507dfb16d58f83a58d78d1150dc8b9d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e07e3b81807edd356e1f794cffa00a428eff443"
        }
      ],
      "title": "thermal: core: Fix thermal zone device registration error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43332",
    "datePublished": "2026-05-08T13:31:19.460Z",
    "dateReserved": "2026-05-01T14:12:56.002Z",
    "dateUpdated": "2026-10-19T19:16:26.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53365 (GCVE-0-2026-53365)

Vulnerability from cvelistv5 – Published: 2026-07-13 17:33 – Updated: 2026-08-18 13:29

Title

vsock/virtio: fix zerocopy completion for multi-skb sends

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages with no completion tracking, so the kernel has no way to notify userspace when those pages are safe to reuse. If the loop breaks early the uarg is never allocated at all, leaking pinned pages with no completion notification. Fix this by following the approach used by TCP: allocate the zerocopy uarg (if not provided by the caller) before the send loop and attach it to every skb via skb_zcopy_set(), which takes a reference per skb. Each skb's completion properly decrements the refcount, and the notification only fires after the last skb is freed. On failure, if no data was sent, the uarg is cleanly aborted via net_zcopy_put_abort(). This issue was initially discovered by sashiko while reviewing commit 1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting") but was pre-existing.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 03:55 UTC

CWE

CWE-404 - Improper Resource Shutdown or Release

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/293fe8f2d1b5ac464…
https://git.kernel.org/stable/c/76b995bc57bd90cb6…
https://git.kernel.org/stable/c/b3155f2b78db21e99…
https://git.kernel.org/stable/c/ae38d9179190a956e…
https://github.com/MaherAzzouzi/vsockdrop	exploit

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < 293fe8f2d1b5ac464ca16a8eba09571bbbb34ba9 (git) Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < 76b995bc57bd90cb6e954e1966fbd8786da47f0d (git) Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < b3155f2b78db21e99256bcf7eb902f24ff6d5338 (git) Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < ae38d9179190a956e2a87a69ef1dd6f451b51c4d (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-53365",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T03:55:24.397803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-404",
                "description": "CWE-404 Improper Resource Shutdown or Release",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T13:29:37.454Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/MaherAzzouzi/vsockdrop"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "293fe8f2d1b5ac464ca16a8eba09571bbbb34ba9",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            },
            {
              "lessThan": "76b995bc57bd90cb6e954e1966fbd8786da47f0d",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            },
            {
              "lessThan": "b3155f2b78db21e99256bcf7eb902f24ff6d5338",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            },
            {
              "lessThan": "ae38d9179190a956e2a87a69ef1dd6f451b51c4d",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix zerocopy completion for multi-skb sends\n\nWhen a large message is fragmented into multiple skbs, the zerocopy\nuarg is only allocated and attached to the last skb in the loop.\nNon-final skbs carry pinned user pages with no completion tracking,\nso the kernel has no way to notify userspace when those pages are safe\nto reuse. If the loop breaks early the uarg is never allocated at all,\nleaking pinned pages with no completion notification.\n\nFix this by following the approach used by TCP: allocate the zerocopy\nuarg (if not provided by the caller) before the send loop and attach\nit to every skb via skb_zcopy_set(), which takes a reference per skb.\nEach skb\u0027s completion properly decrements the refcount, and the\nnotification only fires after the last skb is freed.\nOn failure, if no data was sent, the uarg is cleanly aborted via\nnet_zcopy_put_abort().\n\nThis issue was initially discovered by sashiko while reviewing commit\n1cb36e252211 (\"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting\")\nbut was pre-existing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:53.406Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/293fe8f2d1b5ac464ca16a8eba09571bbbb34ba9"
        },
        {
          "url": "https://git.kernel.org/stable/c/76b995bc57bd90cb6e954e1966fbd8786da47f0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3155f2b78db21e99256bcf7eb902f24ff6d5338"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae38d9179190a956e2a87a69ef1dd6f451b51c4d"
        }
      ],
      "title": "vsock/virtio: fix zerocopy completion for multi-skb sends",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53365",
    "datePublished": "2026-07-13T17:33:52.863Z",
    "dateReserved": "2026-06-09T07:44:35.400Z",
    "dateUpdated": "2026-08-18T13:29:37.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63899 (GCVE-0-2026-63899)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55

Title

USB: serial: mxuport: fix memory corruption with small endpoint

Summary

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/086b858b5f5125bc9…
https://git.kernel.org/stable/c/2f3661eb2446e1ef5…
https://git.kernel.org/stable/c/ccbec56f2f9af008f…
https://git.kernel.org/stable/c/be3a1ed4ae51fa8dd…
https://git.kernel.org/stable/c/e906545641d34fb1a…
https://git.kernel.org/stable/c/6c0cf56f00f280d72…
https://git.kernel.org/stable/c/b40166b4ef9606762…
https://git.kernel.org/stable/c/4085f0dbb1ce2251c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < 086b858b5f5125bc9d967ea2bd825f83d9f8f29d (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < 2f3661eb2446e1ef593da45e01a3b21a906768ec (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < ccbec56f2f9af008f1574335cc6a668f16603e47 (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < be3a1ed4ae51fa8dde57383277d336ce834f2cd9 (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < e906545641d34fb1a09a65b4b5cfdff40eb09681 (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < 6c0cf56f00f280d72180bb6ce79741bc787a6269 (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < b40166b4ef96067620a0f248e74ad9658c8f680c (git) Affected: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e , < 4085f0dbb1ce2251c9a5938d693de6593f0ab2bd (git)
Linux	Linux	Affected: 3.14 Unaffected: 0 , < 3.14 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/mxuport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "086b858b5f5125bc9d967ea2bd825f83d9f8f29d",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "2f3661eb2446e1ef593da45e01a3b21a906768ec",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "ccbec56f2f9af008f1574335cc6a668f16603e47",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "be3a1ed4ae51fa8dde57383277d336ce834f2cd9",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "e906545641d34fb1a09a65b4b5cfdff40eb09681",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "6c0cf56f00f280d72180bb6ce79741bc787a6269",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "b40166b4ef96067620a0f248e74ad9658c8f680c",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            },
            {
              "lessThan": "4085f0dbb1ce2251c9a5938d693de6593f0ab2bd",
              "status": "affected",
              "version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/mxuport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mxuport: fix memory corruption with small endpoint\n\nMake sure that the bulk-out endpoint max packet size is at least eight\nbytes to avoid user-controlled slab corruption should a malicious device\nreport a smaller size."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:08.116Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/086b858b5f5125bc9d967ea2bd825f83d9f8f29d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f3661eb2446e1ef593da45e01a3b21a906768ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccbec56f2f9af008f1574335cc6a668f16603e47"
        },
        {
          "url": "https://git.kernel.org/stable/c/be3a1ed4ae51fa8dde57383277d336ce834f2cd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e906545641d34fb1a09a65b4b5cfdff40eb09681"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c0cf56f00f280d72180bb6ce79741bc787a6269"
        },
        {
          "url": "https://git.kernel.org/stable/c/b40166b4ef96067620a0f248e74ad9658c8f680c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd"
        }
      ],
      "title": "USB: serial: mxuport: fix memory corruption with small endpoint",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63899",
    "datePublished": "2026-07-19T14:55:08.116Z",
    "dateReserved": "2026-07-19T07:54:57.019Z",
    "dateUpdated": "2026-07-19T14:55:08.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63962 (GCVE-0-2026-63962)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-10-30 12:27

Title

usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() svdm_consume_modes() checks pmdata->altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. In the well-behaved SVDM discovery flow this is harmless because each of at most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX modes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX]. But the CMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming ACK with any request the port actually sent. Once port->partner is set, an unsolicited Discover Modes ACK is consumed unconditionally. A broken or malicious port partner can therefore drive altmodes to ALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra Discover Modes ACK with seven VDOs. Because the pre-loop check passes, the loop could then writes up to five entries past altmode_desc[]. For mode_data_prime the next field in struct tcpm_port is the partner_altmode[] pointer array, which then receives partner-chosen SVID/VDO bytes. Move the bound check inside the loop so the array can never be indexed past ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner supplies or how the function was reached.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/f6694bac643c7ae25…
https://git.kernel.org/stable/c/816c6251409db28f1…
https://git.kernel.org/stable/c/845598b154b9a92e9…
https://git.kernel.org/stable/c/4505f33dab56c274e…
https://git.kernel.org/stable/c/cbad85b446c06adbc…
https://git.kernel.org/stable/c/3389c149c68c3fea6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4ab8c18d4d67321cc7b660559de17511d4fc0237 , < f6694bac643c7ae25c0634b63e67d573ed31e5b7 (git) Affected: 4ab8c18d4d67321cc7b660559de17511d4fc0237 , < 816c6251409db28f1b875988fcbd2ff1764a81f0 (git) Affected: 4ab8c18d4d67321cc7b660559de17511d4fc0237 , < 845598b154b9a92e9d279fafafa9405c121ae805 (git) Affected: 4ab8c18d4d67321cc7b660559de17511d4fc0237 , < 4505f33dab56c274e82f47f94bf60a8cbf8f4b42 (git) Affected: 4ab8c18d4d67321cc7b660559de17511d4fc0237 , < cbad85b446c06adbc5e5bed565871bb918ce9d32 (git) Affected: 4ab8c18d4d67321cc7b660559de17511d4fc0237 , < 3389c149c68c3fea61910ad5d34f7bf3bff44e32 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/tcpm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6694bac643c7ae25c0634b63e67d573ed31e5b7",
              "status": "affected",
              "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
              "versionType": "git"
            },
            {
              "lessThan": "816c6251409db28f1b875988fcbd2ff1764a81f0",
              "status": "affected",
              "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
              "versionType": "git"
            },
            {
              "lessThan": "845598b154b9a92e9d279fafafa9405c121ae805",
              "status": "affected",
              "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
              "versionType": "git"
            },
            {
              "lessThan": "4505f33dab56c274e82f47f94bf60a8cbf8f4b42",
              "status": "affected",
              "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
              "versionType": "git"
            },
            {
              "lessThan": "cbad85b446c06adbc5e5bed565871bb918ce9d32",
              "status": "affected",
              "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
              "versionType": "git"
            },
            {
              "lessThan": "3389c149c68c3fea61910ad5d34f7bf3bff44e32",
              "status": "affected",
              "version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/tcpm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()\n\nsvdm_consume_modes() checks pmdata-\u003ealtmodes against the array size once\nbefore the loop over the count, but forgot to check the bound at every\npoint in the loop.\n\nIn the well-behaved SVDM discovery flow this is harmless because each of\nat most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX\nmodes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX].  But the\nCMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming\nACK with any request the port actually sent.  Once port-\u003epartner is set,\nan unsolicited Discover Modes ACK is consumed unconditionally.  A broken\nor malicious port partner can therefore drive altmodes to\nALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra\nDiscover Modes ACK with seven VDOs.  Because the pre-loop check passes,\nthe loop could then writes up to five entries past altmode_desc[].  For\nmode_data_prime the next field in struct tcpm_port is the\npartner_altmode[] pointer array, which then receives partner-chosen\nSVID/VDO bytes.\n\nMove the bound check inside the loop so the array can never be indexed\npast ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner\nsupplies or how the function was reached."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:27:23.506Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6694bac643c7ae25c0634b63e67d573ed31e5b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/816c6251409db28f1b875988fcbd2ff1764a81f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/845598b154b9a92e9d279fafafa9405c121ae805"
        },
        {
          "url": "https://git.kernel.org/stable/c/4505f33dab56c274e82f47f94bf60a8cbf8f4b42"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbad85b446c06adbc5e5bed565871bb918ce9d32"
        },
        {
          "url": "https://git.kernel.org/stable/c/3389c149c68c3fea61910ad5d34f7bf3bff44e32"
        }
      ],
      "title": "usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63962",
    "datePublished": "2026-07-19T14:55:51.682Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-10-30T12:27:23.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63970 (GCVE-0-2026-63970)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-10-19 20:17

Title

vsock/virtio: bind uarg before filling zerocopy skb

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio_transport_alloc_skb() still fills the skb before it inherits that uarg. When fixed-buffer vectored zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach managed frags and return -EMSGSIZE. The rollback path call kfree_skb() to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so skb_release_data() falls through to ordinary frag unref. Pass the uarg into virtio_transport_alloc_skb() and bind it immediately before virtio_transport_fill_skb(). This keeps control or no-payload skbs untouched while ensuring success and rollback share one lifetime rule.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:34 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/72194f65050958e4c…
https://git.kernel.org/stable/c/b62e2b2b4a50953ca…
https://git.kernel.org/stable/c/5d317573f1d48e76c…
https://git.kernel.org/stable/c/1e584c304cfb94a75…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < 72194f65050958e4c8e069adb6c5d89ef81ca197 (git) Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d (git) Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < 5d317573f1d48e76cce5fb6250452b6e4102e0fb (git) Affected: 581512a6dc939ef122e49336626ae159f3b8a345 , < 1e584c304cfb94a759417130b1fc6d30b30c4cce (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63970",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:34:15.768672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:17:59.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72194f65050958e4c8e069adb6c5d89ef81ca197",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            },
            {
              "lessThan": "b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            },
            {
              "lessThan": "5d317573f1d48e76cce5fb6250452b6e4102e0fb",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            },
            {
              "lessThan": "1e584c304cfb94a759417130b1fc6d30b30c4cce",
              "status": "affected",
              "version": "581512a6dc939ef122e49336626ae159f3b8a345",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_transport_alloc_skb() still\nfills the skb before it inherits that uarg. When fixed-buffer vectored\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so\nskb_release_data() falls through to ordinary frag unref.\n\nPass the uarg into virtio_transport_alloc_skb() and bind it immediately\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs\nuntouched while ensuring success and rollback share one lifetime rule."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender\u0027s local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:41.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197"
        },
        {
          "url": "https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce"
        }
      ],
      "title": "vsock/virtio: bind uarg before filling zerocopy skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63970",
    "datePublished": "2026-07-19T14:55:57.067Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-10-19T20:17:59.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64018 (GCVE-0-2026-64018)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-10-19 20:28

Title

net: mana: validate rx_req_idx to prevent out-of-bounds array access

Summary

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:35 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/5ddc715324badd7f2…
https://git.kernel.org/stable/c/ff1d5af207bcea857…
https://git.kernel.org/stable/c/01f7f893d5e1baae9…
https://git.kernel.org/stable/c/763a372d344fb12fa…
https://git.kernel.org/stable/c/fa627a5eaa83fc026…
https://git.kernel.org/stable/c/355e9f2b2a7887ca3…
https://git.kernel.org/stable/c/b809d0409991b75a6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 5ddc715324badd7f2641bc177db1d027b402adae (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < ff1d5af207bcea857d45fe81505f1bc4b29eaef0 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 763a372d344fb12fae566d36ddb46e92454ad58c (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < fa627a5eaa83fc0261f44ef3769693b886ca6e27 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 355e9f2b2a7887ca38100127989af3e422ba71d0 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < b809d0409991b75a6cff846a5ac27c3062953f84 (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:35:22.459884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:08.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/hw_channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ddc715324badd7f2641bc177db1d027b402adae",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "ff1d5af207bcea857d45fe81505f1bc4b29eaef0",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "763a372d344fb12fae566d36ddb46e92454ad58c",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "fa627a5eaa83fc0261f44ef3769693b886ca6e27",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "355e9f2b2a7887ca38100127989af3e422ba71d0",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "b809d0409991b75a6cff846a5ac27c3062953f84",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/hw_channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: validate rx_req_idx to prevent out-of-bounds array access\n\nIn mana_hwc_rx_event_handler(), rx_req_idx is derived from\nsge-\u003eaddress in DMA-coherent memory. In Confidential VMs\n(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify\nWQE contents at any time. No bounds check exists on rx_req_idx,\nwhich can lead to an out-of-bounds access into reqs[].\n\nAdd bounds check on rx_req_idx in mana_hwc_rx_event_handler() before\nusing it to index the reqs[] array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge-\u003eaddress and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:15.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0"
        },
        {
          "url": "https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01"
        },
        {
          "url": "https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27"
        },
        {
          "url": "https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84"
        }
      ],
      "title": "net: mana: validate rx_req_idx to prevent out-of-bounds array access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64018",
    "datePublished": "2026-07-19T15:39:12.704Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-10-19T20:28:08.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64034 (GCVE-0-2026-64034)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-10-19 20:28

Title

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

Summary

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:35 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6643 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/a201c66edf2ebc6cf…
https://git.kernel.org/stable/c/70ad2dff8d052a85d…
https://git.kernel.org/stable/c/566f42fb67a7ebfed…
https://git.kernel.org/stable/c/6180a06bbc99fd911…
https://git.kernel.org/stable/c/09ec063d87c2dd3fa…
https://git.kernel.org/stable/c/3c4db56ccd13dd020…
https://git.kernel.org/stable/c/35f0f0a2536a4d604…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < a201c66edf2ebc6cfdc3813a889ba20fecebfae3 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 70ad2dff8d052a85dfef15715b531f38a29108cf (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 566f42fb67a7ebfed6650e407e5b72e6b3e83bf7 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 6180a06bbc99fd9114b8db4be6c4d46e40f046ef (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 09ec063d87c2dd3fa6f3561361a017bd882e9f37 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 3c4db56ccd13dd020fbf43afabaee74a40ec75e4 (git) Affected: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f , < 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870 (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:35:42.542411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:09.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/hw_channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a201c66edf2ebc6cfdc3813a889ba20fecebfae3",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "70ad2dff8d052a85dfef15715b531f38a29108cf",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "566f42fb67a7ebfed6650e407e5b72e6b3e83bf7",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "6180a06bbc99fd9114b8db4be6c4d46e40f046ef",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "09ec063d87c2dd3fa6f3561361a017bd882e9f37",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "3c4db56ccd13dd020fbf43afabaee74a40ec75e4",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            },
            {
              "lessThan": "35f0f0a2536a4d604b4dbad92c85c4a8fdebb870",
              "status": "affected",
              "version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/hw_channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer\n\nIn mana_hwc_rx_event_handler(), resp-\u003eresponse.hwc_msg_id is read from\nDMA-coherent memory and bounds-checked, then mana_hwc_handle_resp()\nre-reads the same field from the same DMA buffer for test_bit() and\npointer arithmetic.\n\nDMA-coherent memory is mapped uncacheable on x86 and is shared,\nunencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes\ndirectly to host-visible memory. A H/W can modify the value\nbetween the check and the use, bypassing the bounds validation.\n\nFix this by reading hwc_msg_id exactly once using READ_ONCE() into a\nstack-local variable in mana_hwc_rx_event_handler(), and passing the\nvalidated value as a parameter to mana_hwc_handle_resp()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest\u0027s data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:28.529Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3"
        },
        {
          "url": "https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870"
        }
      ],
      "title": "net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64034",
    "datePublished": "2026-07-19T15:39:23.470Z",
    "dateReserved": "2026-07-19T07:54:57.028Z",
    "dateUpdated": "2026-10-19T20:28:09.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:97873

CVE-2025-22063 (GCVE-0-2025-22063)

CVE-2025-38004 (GCVE-0-2025-38004)

CVE-2025-38147 (GCVE-0-2025-38147)

CVE-2026-43332 (GCVE-0-2026-43332)

CVE-2026-53365 (GCVE-0-2026-53365)

CVE-2026-63899 (GCVE-0-2026-63899)

CVE-2026-63962 (GCVE-0-2026-63962)

CVE-2026-63970 (GCVE-0-2026-63970)

CVE-2026-64018 (GCVE-0-2026-64018)

CVE-2026-64034 (GCVE-0-2026-64034)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour