{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/svc-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c099b0b292a68d0ef558527945dbfb756fbf893",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            },
            {
              "lessThan": "7cc5ba756bc1cfffab9cb2695742f9f479dc73f7",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            },
            {
              "lessThan": "35aa6730b8c5626b879a4e893fe664f59bf07d7f",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            },
            {
              "lessThan": "f296a0d5907bf88314dfda67245f7f69d1552470",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            },
            {
              "lessThan": "5697d779577e2786ff3348ae9b77020ac0cf0aab",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            },
            {
              "lessThan": "aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            },
            {
              "lessThan": "e2bda39d7f9f285ec803e200b5c1f17143d0b483",
              "status": "affected",
              "version": "dd3c52846d5954acd43f0e771689302f27dadc28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/svc-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: bound IBI payload to the requested max_payload_len\n\nsvc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into\nthe IBI slot. The loop is bounded by the hardware FIFO size\n(SVC_I3C_FIFO_SIZE), not by the slot size.\n\nslot-\u003edata points into the IBI pool, which i3c_generic_ibi_alloc_pool()\nsizes at max_payload_len per slot. svc_i3c_master_request_ibi() only\nrejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can\nrequest a smaller one. mctp-i3c requests 1. Each readsb() then copies the\ncontroller RXCOUNT bytes (up to 31) with no check against the slot size.\nA device that sends more bytes than the slot holds writes past\nslot-\u003edata, an out-of-bounds write into the IBI pool.\n\nBound the loop by dev-\u003eibi-\u003emax_payload_len and clamp each read to the\nspace left in the slot, the same way dw-i3c does. A device can still send\nmore than the requested payload. Flush the leftover bytes from the RX FIFO\nso they do not leak into the next transfer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:45:35.194Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c099b0b292a68d0ef558527945dbfb756fbf893"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cc5ba756bc1cfffab9cb2695742f9f479dc73f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/35aa6730b8c5626b879a4e893fe664f59bf07d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f296a0d5907bf88314dfda67245f7f69d1552470"
        },
        {
          "url": "https://git.kernel.org/stable/c/5697d779577e2786ff3348ae9b77020ac0cf0aab"
        },
        {
          "url": "https://git.kernel.org/stable/c/aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2bda39d7f9f285ec803e200b5c1f17143d0b483"
        }
      ],
      "title": "i3c: master: svc: bound IBI payload to the requested max_payload_len",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80951",
    "datePublished": "2026-09-11T19:42:21.115Z",
    "dateReserved": "2026-08-26T14:34:25.804Z",
    "dateUpdated": "2026-10-19T08:45:35.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ea443510739468238324234eaab0d37922283f5",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "22dc712c170efc1a549e3f872467c880be995ac7",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "530ee1cc71562b6799b9ece187b6c1b757a2c6fa",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "647916988272fe5ecb4bb30cd02b51af9960618a",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "0fd74477d05743d4cd9b25a3b667daa278d53b93",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            },
            {
              "lessThan": "7fa61c29850d05e40ca9ed41bfdf57673023f581",
              "status": "affected",
              "version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/vfio_ap_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects\n\nIn order to traverse or add/remove ap_matrix_mdev objects in the\nmatrix_dev-\u003emdev_list, the matrix_dev-\u003eguests_lock mutex must be held.\nThere are two functions that access the list without holding the mutex:\n\nvfio_ap_mdev_probe function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe vfio_ap_mdev_probe function uses the matrix_dev-\u003emdevs_lock\nmutex to guard the add of a newly created ap_matrix_mdev object to the\nmatrix_dev-\u003emdev_list. This mutex does not protect list access; its purpose\nis to guard against concurrent access to fields contained in an\nap_matrix_mdev object. This could lead to kernel memory corruption or\nuse-after-free if another mdev is created or removed concurrently.\n\nThe adding of an ap_matrix_mdev object to matrix_dev-\u003emdev_list\nis now guarded by the matrix_dev-\u003eguests_lock which is the correct\nway to protect against concurrent mdev_list access.\n\nAlso removed the following two lines of code because the matrix_mdev is\nallocated via vfio_alloc_device macro which uses kzalloc, so req_trigger\nand cfg_chg_trigger are already zero-initialised when the struct is\nallocated before the call to vfio_register_emulated_iommu_dev. This\nprevents a window whereby these triggers are set to NULL after\nthe device is exposed to userspace.\n\nmatrix_mdev-\u003ereq_trigger = NULL;\nmatrix_mdev-\u003ecfg_chg_trigger = NULL;\n\nvfio_ap_mdev_for_queue function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe status_show function that supports display of the status attribute of\nthe devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue\nfunction which iterates the matrix_dev-\u003emdev_list to find the object\nrepresenting the queue device whose status is to be displayed. In order to\ntraverse this list, the matrix_dev-\u003eguests_lock mutex must be held.\n\nTo fix this, the guests_lock mutex is taken prior to taking the\nmatrix_dev-\u003emdevs_lock mutex in the status_show function. It is taken\nthere rather than the vfio_ap_mdev_for_queue function - where it is\nneeded - because it must be taken prior to the mdevs_lock mutex in order to\nadhere to the proper locking order and prevent a lockdep splat; also\nbecause the mdevs_lock is needed there to access fields within\nthe matrix_mdev object in that function.\n\nSee the vfio-ap-locking.rst in the linux kernel tree."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:33:34.479Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ea443510739468238324234eaab0d37922283f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/22dc712c170efc1a549e3f872467c880be995ac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/530ee1cc71562b6799b9ece187b6c1b757a2c6fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/647916988272fe5ecb4bb30cd02b51af9960618a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fd74477d05743d4cd9b25a3b667daa278d53b93"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fa61c29850d05e40ca9ed41bfdf57673023f581"
        }
      ],
      "title": "s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89956",
    "datePublished": "2026-09-16T10:32:39.847Z",
    "dateReserved": "2026-09-11T19:38:34.778Z",
    "dateUpdated": "2026-10-30T12:33:34.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "de76a2b47582cd6dba2e15f024681bf377ecc94a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "89d986897aff7275b42e075e556731b8353366af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6290afaae54c7a9fa3bca3b4d5433e6d83e8669d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "210c193a9ef1312fab153948c6928e4cfaa1f03b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "403f7f3ad3808a0096d84cf228fab68dc253fd9d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: midi: Serialize input teardown with event_input\n\nsnd_midi_input_event() must not be running while a rawmidi substream is\nclosing, since this can lead to the trigger state becoming out-of-step\nthrough this sequence in snd_rawmidi_input_trigger():\n\n\tsnd_rawmidi_input_trigger(up=0)\n\t\t\t\t\tsnd_midi_input_event()\n\t\t\t\t\t -\u003e snd_rawmidi_kernel_read()\n\t\t\t\t\t     -\u003e snd_rawmidi_input_trigger(up=1)\n\t  -\u003e cancel_work_sync()\n\nwhich ends with the underlying device being active unexpectedly.\n\nWhen this is called from close_substream(), further input can re-trigger\nthe input event leaving it running after rawmidi_release_priv() has set\nrfile-\u003ermidi to NULL which leads to:\n\n\tUnable to handle kernel NULL pointer dereference at virtual address 00000000000000b0\n\tCall trace:\n\t snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P)\n\t snd_rawmidi_input_event_work+0x1c/0x2c\n\t process_one_work+0x150/0x3a4\n\t worker_thread+0x190/0x318\n\nApply a similar approach to commit ef7607ab1c8ad (\"ALSA: seq: midi:\nSerialize output teardown with event_input\") which fixed the same issue\nin the output direction, but updated to use RCU following Takashi Iwai\u0027s\nproposed follow-on patch [1].\n\nWith this change in place, midisynth_unsubscribe() clears the input file\nso snd_midi_input_event() will not re-trigger the stream and will be\nquiesced by the cancel_work_sync() in snd_rawmidi_input_trigger().\n\n[1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is reached from a local sequencer client: snd_seq_open() on /dev/snd/seq, SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT (midisynth_subscribe) to open the rawmidi input, then SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT or client close (midisynth_unsubscribe -\u003e snd_rawmidi_kernel_release). Bytes that schedule snd_midi_input_event come from the bound rawmidi device, not a network or radio protocol.\nAC:L - The attacker owns teardown (last unsubscribe/close) and starts input by subscribing: midisynth_subscribe sets runtime-\u003eevent to snd_midi_input_event and snd_rawmidi_kernel_read() triggers the device. Concurrent snd_midi_input_event can re-call snd_rawmidi_input_trigger(up=1) during close_substream\u0027s trigger(up=0)/cancel_work_sync window. Repeating subscribe/unsubscribe on that live port makes the race retryable.\nPR:L - snd_seq_open() has no capable() check. check_subscription_permission() allows any sequencer client to subscribe to seq_midi ports because they advertise SNDRV_SEQ_PORT_CAP_READ|SNDRV_SEQ_PORT_CAP_SUBS_READ. Typical DAC on /dev/snd/seq is audio-group/uaccess, so an unprivileged local user suffices; init-namespace root is not required.\nUI:N - The attacker opens their own /dev/snd/seq client, creates a destination port, issues SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT to a seq_midi input port, and then unsubscribes or closes to run midisynth_unsubscribe. No other user must mount, click, or open a file.\nS:U - The UAF/NULL deref is in kernel rawmidi lifetime (close_substream/snd_rawmidi_runtime_free versus snd_rawmidi_input_event_work calling snd_midi_input_event). That is local kernel memory corruption in the same OS authority, not a VM, IOMMU, or sandbox escape.\nC:H - After cancel_work_sync, a re-triggered device can schedule runtime-\u003eevent_work; close_substream then kfree()s snd_rawmidi_runtime while the work later does container_of() and calls runtime-\u003eevent. Use-after-free of that heap object enables arbitrary reads via heap reuse of the freed runtime.\nI:H - The freed snd_rawmidi_runtime embeds event_work and the runtime-\u003eevent function pointer that snd_rawmidi_input_event_work invokes. Heap spraying that object lets an attacker hijack the callback for arbitrary kernel write or control-flow hijack, not merely a one-shot crash.\nA:H - The reported crash is a NULL deref in snd_midi_input_event from snd_rawmidi_input_event_work after rawmidi_release_priv() nulls the file and close_substream frees runtime, which oopses the kernel and can be retried with subscribe/unsubscribe cycles."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:59:43.508Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a"
        },
        {
          "url": "https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af"
        },
        {
          "url": "https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d"
        },
        {
          "url": "https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b"
        },
        {
          "url": "https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12"
        },
        {
          "url": "https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d"
        }
      ],
      "title": "ALSA: seq: midi: Serialize input teardown with event_input",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90207",
    "datePublished": "2026-09-17T16:07:22.825Z",
    "dateReserved": "2026-09-11T19:38:34.793Z",
    "dateUpdated": "2026-10-19T08:59:43.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6cdd2a0470d64073349a970dc1691433804b271",
              "status": "affected",
              "version": "33061d0fba51d2bf70a2ef9645f703c33fe8e438",
              "versionType": "git"
            },
            {
              "lessThan": "9857a75714bb5df4781e4d8b1a1753b1e17bf07a",
              "status": "affected",
              "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "versionType": "git"
            },
            {
              "lessThan": "cbadf2575d25e7dcc0d4da2717817ae569fbc99b",
              "status": "affected",
              "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "versionType": "git"
            },
            {
              "lessThan": "cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5",
              "status": "affected",
              "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "versionType": "git"
            },
            {
              "lessThan": "fd137bf8149bc6460f9b7b1fc292025da04cb9ee",
              "status": "affected",
              "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "versionType": "git"
            },
            {
              "lessThan": "8c1882dfee8f404d118020664b73eb4592172226",
              "status": "affected",
              "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "versionType": "git"
            },
            {
              "lessThan": "9b110a9dcecc59516c77cb3c0caf1f492f75df2d",
              "status": "affected",
              "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a42aa926843acca96c0dfbde2e835b8137f2f092",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9cb6c40a6ebe4a0cfc9d6a181958211682cffea9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fbeb492694ce0441053de57699e1e2b7bc148a69",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0f6947f5f5208f6ebd4d76a82a4757e2839a23f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0090c13cbbdffd7da079ac56f80373a9a1be0bf8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1bbf82d9f961414d6c76a08f7f843ea068e0ab7b",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.222",
              "status": "affected",
              "version": "5.15.32",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.279",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.243",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.193",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.109",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.15.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.279",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.243",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.193",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.109",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between.  snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer\u0027s state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree.  remap_pfn_range() installs writable PTEs for the old buffer\u0027s\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them.  This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime-\u003ebuffer_accessing\nbefore validating and remapping, and release it afterwards.  Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by mmap() on a local /dev/snd/pcmC*D* file descriptor (snd_pcm_mmap -\u003e snd_pcm_mmap_data) racing with SNDRV_PCM_IOCTL_HW_PARAMS/HW_FREE ioctls on the same fd. No remote protocol carries any of the inputs.\nAC:L - One process controls both sides of the race: one thread calls mmap() and another calls hw_free/hw_params. The window runs from the mmap_count check under the stream lock through snd_pcm_sync_stop and refinement to do_free_pages, and the attacker can retry as often as needed.\nPR:L - Opening the PCM device node takes ordinary local user access, either the audio group or the udev uaccess ACL given to the logged-in seat user. No capability is checked on the mmap or hw_params/hw_free paths.\nUI:N - The attacker opens the device, sets hw_params and races the mmap against hw_free entirely through their own syscalls. No other user has to do anything.\nS:U - This is a local kernel privilege escalation within the same kernel security authority. It crosses no VM or IOMMU boundary.\nC:H - remap_pfn_range installs PTEs for the old DMA buffer pages without taking page references, and do_free_pages then frees them. The attacker keeps a direct mapping of whatever the page allocator reuses those pages for, such as page tables, cred or slab pages, and can read it.\nI:H - The stale mapping of the freed buffer pages is writable, which gives direct write access to reallocated kernel pages. This is a page-level UAF that enables privilege escalation, as the fix commit itself states.\nA:H - Writing through the stale PTEs into pages that have been reallocated corrupts arbitrary kernel memory, which leads to oopses, panics or page-state BUGs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:14:08.504Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6cdd2a0470d64073349a970dc1691433804b271"
        },
        {
          "url": "https://git.kernel.org/stable/c/9857a75714bb5df4781e4d8b1a1753b1e17bf07a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbadf2575d25e7dcc0d4da2717817ae569fbc99b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d"
        }
      ],
      "title": "ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98116",
    "datePublished": "2026-09-25T10:36:01.723Z",
    "dateReserved": "2026-09-25T10:25:14.317Z",
    "dateUpdated": "2026-10-19T09:14:08.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/reparse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6913ff607c2bc8694193e1fcc40bf16d75f35f16",
              "status": "affected",
              "version": "3363da82e02f1bddc54faa92ea430c6532e2cd2e",
              "versionType": "git"
            },
            {
              "lessThan": "23c240d9509e15f72e4112fc95f0160ab32ec430",
              "status": "affected",
              "version": "3363da82e02f1bddc54faa92ea430c6532e2cd2e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b6ea7b6c6be65149ab6b8e37a9dd1671f76add1b",
              "versionType": "git"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/reparse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate absolute native symlink targets before NT fixups\n\nWith symlinkroot unset, an absolute target is copied without conversion\nto an NT drive path. Later code still assumes an NT prefix is present\nwhen modifying the target and calculating the print name length.\n\nFor \"/ab\", this causes two failures: sym[5] and path[5] are written\npast their allocations, and plen -= 2 * poff subtracts an assumed\n8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534.\nThat underflow causes another overflow: memcpy() copies 65534 bytes\ninto a 24-byte buffer. A user with write access to a mounted share\ncan trigger these bugs with default settings.\n\nValidate the NT drive prefix, including an ASCII drive letter, before\naccessing fixed offsets or subtracting the prefix length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed input is the symlink target string a local user passes to symlink(2) on a CIFS mount (cifs_symlink -\u003e create_reparse_symlink -\u003e create_native_symlink); the SMB server supplies none of the bad data, and the overflow happens before any request is sent.\nAC:L - With default options (reparse_type defaults to NFS so cifs_symlink_type() returns NATIVE, symlinkroot unset) a target like \"/ab\" deterministically triggers the plen underflow; detect_directory_symlink_target() returns 0 for absolute targets, so nothing on the path depends on state outside the attacker\u0027s control.\nPR:L - The attacker needs only an ordinary local account with write access to a directory on an already-mounted CIFS share whose server advertises FILE_SUPPORTS_REPARSE_POINTS; cifs is not mountable from user namespaces, so no further privilege is gained there.\nUI:N - The attacker triggers the bug entirely through their own symlink(2) call; no victim action is needed beyond the share already being mounted.\nS:U - Heap corruption in the CIFS client stays within the local kernel\u0027s security authority; this is ordinary local privilege escalation or crash with no VM or IOMMU boundary crossed.\nC:H - memcpy(buf-\u003ePathBuffer, path+poff, plen) reads 65534 bytes past the small UTF-16 path allocation, and the matching heap overflow can be groomed into read primitives over adjacent slab objects.\nI:H - Out-of-bounds heap writes: sym[5]/path[5] past their allocations, and a 65534-byte memcpy into a 24-byte kzalloc buffer after u16 plen and len wrap, corrupting adjacent slab objects in a way usable for control-flow hijack.\nA:H - The 64 KiB overflow of the kmalloc buffer corrupts large amounts of slab memory and reliably oopses or panics the kernel, and any user with write access to the share can repeat it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:17:28.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6913ff607c2bc8694193e1fcc40bf16d75f35f16"
        },
        {
          "url": "https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430"
        }
      ],
      "title": "smb: client: validate absolute native symlink targets before NT fixups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98318",
    "datePublished": "2026-10-06T08:46:13.140Z",
    "dateReserved": "2026-09-25T10:25:14.340Z",
    "dateUpdated": "2026-10-19T09:17:28.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/ipl_parm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af9866021a00ab9eeacf0c33ee73f3d134b4ed70",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            },
            {
              "lessThan": "73eec5a0d55916d7e1115f5d03a7ffc06d6215cf",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            },
            {
              "lessThan": "8d11bfec8666f8409fac9072e9c25b691d3e30ac",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            },
            {
              "lessThan": "d76181dfabdaa720703167393704efacba343442",
              "status": "affected",
              "version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/ipl_parm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with \u0027=\u0027 can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:56.682Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70"
        },
        {
          "url": "https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"
        }
      ],
      "title": "s390/boot: Avoid IPL parameter append past command line",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98403",
    "datePublished": "2026-10-14T13:26:02.916Z",
    "dateReserved": "2026-09-25T10:25:14.347Z",
    "dateUpdated": "2026-10-19T09:18:56.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf4035656852a386fecb5d6217710a1bde536e76",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "5b56229cc152095fbe4e4ff537cb206c4aa41610",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "7a7a473aec51195778a54fdd71f20fda3047b8ef",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "77134cf996bab55683f0ceafb9e300d97ac046f8",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "e96ae694c5038aae84142b64e41b56324b7af9a7",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "55a65ef61e2775aeb18fda63bd1959fa8b41f936",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "f721487523d45941aed4b0ac8d829b0461a7d860",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            },
            {
              "lessThan": "11bffcd9cb346732eab2914ef44fe777a3f0b585",
              "status": "affected",
              "version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.161",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.115",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the task named by a management response\n\n__iscsi_complete_pdu() fetches the task for five response types from one\nplace and checks only that the index resolved:\n\n      case ISCSI_OP_LOGOUT_RSP:\n      case ISCSI_OP_LOGIN_RSP:\n      case ISCSI_OP_TEXT_RSP:\n      case ISCSI_OP_SCSI_TMFUNC_RSP:\n      case ISCSI_OP_NOOP_IN:\n              task = iscsi_itt_to_task(conn, hdr-\u003eitt);\n              if (!task)\n                      return ISCSI_ERR_BAD_ITT;\n\niscsi_itt_to_task() bounds the index against cmds_max and looks at\nnothing else, so a target can name any slot in the pool, including one\nthat has never been used. task-\u003econn is then NULL, and both\niscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One\nunsolicited NOP-In is enough; a Text Response carrying the same ITT\ncrashes in iscsi_complete_task() instead.\n\nRequire the task to be in flight and not a SCSI command, the way\niscsi_itt_to_ctask() does for the command opcodes.\n\n[    6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[    6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[    6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[    6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[    6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[    6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206\n[    6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020\n[    6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060\n[    6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[    6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000\n[    6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800\n[    6.298707] FS:  00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000\n[    6.298710] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0\n[    6.298712] PKRU: 55555554\n[    6.298713] Call Trace:\n[    6.298714]  \u003cIRQ\u003e\n[    6.298714]  __iscsi_complete_pdu+0x13a8/0x22a0\n[    6.298758]  iscsi_complete_pdu+0x54/0xa0\n[    6.298759]  iscsi_tcp_hdr_recv_done+0x870/0x2c80\n[    6.298778]  iscsi_tcp_recv_skb+0x31e/0xec0\n[    6.298800]  iscsi_sw_tcp_recv+0x12f/0x390\n[    6.298804]  __tcp_read_sock+0x1ab/0x810\n[    6.298812]  iscsi_sw_tcp_data_ready+0x18b/0x510\n[    6.298814]  tcp_rcv_established+0x1f56/0x3a00\n[    6.298842]  tcp_v4_do_rcv+0x449/0x960\n[    6.298847]  tcp_v4_rcv+0x2245/0x3bc0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An iSCSI target supplies the forged ITT in an ISCSI_OP_NOOP_IN PDU over routable TCP; iscsi_sw_tcp_data_ready() through iscsi_tcp_hdr_dissect() and iscsi_complete_pdu() reaches the patched __iscsi_complete_pdu().\nAC:L - iscsi_pool_init() zeroes every task and iscsi_conn_setup() removes only the login task, leaving deterministic in-range slots with task-\u003econn NULL. One NOP-In with the session age, a free-slot index, reserved TTT, and no data triggers the fault without a race.\nPR:N - iscsi_sw_tcp_conn_bind() enables receive processing before iscsi_conn_start() marks the session logged in, while __iscsi_complete_pdu() has no CHAP or session-state gate. The target therefore needs no credentials or local capability.\nUI:N - On a bound or automatically restored iSCSI session, iscsi_sw_tcp_data_ready() parses the target\u0027s NOP-In immediately; no user must open data or perform another action.\nS:U - __iscsi_complete_pdu() misidentifies a task inside the host kernel\u0027s own iscsi_session pool, and the resulting fault affects that same kernel without crossing a VM, IOMMU, or other security boundary.\nC:N - iscsi_nop_out_rsp() reads conn-\u003eping_task through the NULL task-\u003econn pointer and exposes no data to the target. Selecting an active SCSI slot returns any unfilled buffer only to the local requester, not to the remote attacker.\nI:N - The NULL-slot path performs no attacker-controlled write. An active SCSI slot can be completed early, but this supplies no host-memory write or control-flow primitive beyond the target\u0027s existing authority to acknowledge its own remote block operations.\nA:H - A single forged NOP-In naming a zeroed free slot makes iscsi_nop_out_rsp() dereference task-\u003econn at conn-\u003eping_task, producing the demonstrated general-protection fault in IRQ context and potentially panicking the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T12:44:00.040Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf4035656852a386fecb5d6217710a1bde536e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b56229cc152095fbe4e4ff537cb206c4aa41610"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a7a473aec51195778a54fdd71f20fda3047b8ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/77134cf996bab55683f0ceafb9e300d97ac046f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e96ae694c5038aae84142b64e41b56324b7af9a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936"
        },
        {
          "url": "https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860"
        },
        {
          "url": "https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585"
        }
      ],
      "title": "scsi: libiscsi: Validate the task named by a management response",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99152",
    "datePublished": "2026-10-28T10:35:07.622Z",
    "dateReserved": "2026-09-25T10:25:14.396Z",
    "dateUpdated": "2026-10-31T12:44:00.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3637a4ad1d07477f1c60609876da6b60154d224b",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "21ef746340ce246344f34278e205b8960c1d8874",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "d20583a9dbe0d32a9af8384c857c95c0fc115103",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "ebb8c5ef2aabf66895253600e8390e8fc7094807",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "576125e7382a7826bd6c3c1ca4d9c582ed5be21d",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "7215a69b6456fda79c0935c2959045dff3fcaac8",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            },
            {
              "lessThan": "c5958c770b2a0ee492414e26b07da9164a0d1f5d",
              "status": "affected",
              "version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.161",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.115",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n      memcpy(\u0026rejected_pdu, data, sizeof(struct iscsi_hdr));\n      ...\n      task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task-\u003econn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task-\u003estate == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[    6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[    6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[    6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[    6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[    6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[    6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[    6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[    6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[    6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[    6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[    6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[    6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[    6.254549] FS:  0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[    6.254887] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[    6.255439] PKRU: 55555554\n[    6.255564] Call Trace:\n[    6.255674]  \u003cIRQ\u003e\n[    6.255768]  __iscsi_complete_pdu+0x18bf/0x22a0\n[    6.256733]  iscsi_complete_pdu+0x54/0xa0\n[    6.256905]  iscsi_tcp_data_recv_done+0xf4/0x250\n[    6.257103]  iscsi_tcp_recv_skb+0x31e/0xec0\n[    6.257680]  iscsi_sw_tcp_recv+0x12f/0x390\n[    6.258061]  __tcp_read_sock+0x1ab/0x810\n[    6.258853]  iscsi_sw_tcp_data_ready+0x18b/0x510\n[    6.259808]  tcp_data_queue+0x1f13/0x4cd0\n[    6.260567]  tcp_rcv_established+0x8a5/0x3a00\n[    6.261931]  tcp_v4_do_rcv+0x449/0x960\n[    6.262269]  tcp_v4_rcv+0x2245/0x3bc0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A target-supplied ISCSI_OP_REJECT traverses iscsi_sw_tcp_data_ready(), iscsi_tcp_recv_skb(), iscsi_tcp_data_recv_done(), iscsi_complete_pdu(), and __iscsi_complete_pdu() to the patched iscsi_handle_reject(); the forged NOOP_OUT ITT is carried in the Reject PDU data over routable TCP.\nAC:L - The target sees live SCSI ITTs in initiator commands and can withhold their responses before naming one in a forged Reject; alternatively, index 1 in a freshly bound kzalloc\u0027ed pool deterministically has task-\u003econn == NULL. No race or uncontrolled condition is required.\nPR:N - iscsi_sw_tcp_conn_bind() installs receive callbacks before iscsi_conn_start() marks the session logged in, while __iscsi_complete_pdu() and iscsi_handle_reject() impose no login-state or authentication check on Reject PDUs. A target can therefore trigger the crash during login without credentials.\nUI:N - Once a configured initiator binds or automatically reconnects its iSCSI socket, the target\u0027s Reject is processed directly by iscsi_sw_tcp_data_ready(); selecting an unused task slot requires no victim read, mount, or other action.\nS:U - iscsi_handle_reject() corrupts task completion state or faults within the initiator host kernel; it does not cross a VM, IOMMU, or separate security-authority boundary.\nC:H - For a READ ITT, iscsi_nop_out_rsp() reaches iscsi_complete_task() and scsi_done() with sc-\u003eresult still zero despite no Data-In; non-zeroed page-cache folios can consequently be marked uptodate and exposed as valid data, with the commit demonstrating a 1 MiB untouched read.\nI:H - The unchecked ITT lets iscsi_nop_out_rsp() falsely complete any observed in-flight SCSI task successfully; untouched READ buffers become valid filesystem data and WRITE commands can be acknowledged without commitment, permitting silent persistent storage or filesystem corruption.\nA:H - Selecting a never-used pool slot returns a task whose kzalloc\u0027ed task-\u003econn is NULL, which iscsi_nop_out_rsp() dereferences; the commit records the resulting general-protection fault, so one crafted Reject can oops or panic the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T12:44:04.972Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874"
        },
        {
          "url": "https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807"
        },
        {
          "url": "https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d"
        }
      ],
      "title": "scsi: libiscsi: Validate the ITT reflected in a Reject PDU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99153",
    "datePublished": "2026-10-28T10:35:08.287Z",
    "dateReserved": "2026-09-25T10:25:14.396Z",
    "dateUpdated": "2026-10-31T12:44:04.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}