{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:06:04.374454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:15:16.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7f0207db68d5a1b4af23acbef1a8e8ddc431ebb",
              "status": "affected",
              "version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
              "versionType": "git"
            },
            {
              "lessThan": "a63998cd6687c14b160dccb0bbcf281b2eb0dab3",
              "status": "affected",
              "version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
              "versionType": "git"
            },
            {
              "lessThan": "0c2413c69129f6ce60157f7b53d9ba880260400b",
              "status": "affected",
              "version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
              "versionType": "git"
            },
            {
              "lessThan": "d52af58dd463821c5c516aebb031a58934f696ea",
              "status": "affected",
              "version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
              "versionType": "git"
            },
            {
              "lessThan": "7ba0b6461bc4edb3005ea6e00cdae189bcf908a5",
              "status": "affected",
              "version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "048605483fbdd1e77ead32a7cd7b95cc17eaaf0e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "033ad030df0ea932a21499582fea59e1df95769b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1653a3b0e9436c10eb307c318776cf91fe18ff08",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ff440e9185e96cbb94481fc8b6192b944dcfc061",
              "versionType": "git"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.32",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.23",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.8",
              "versionType": "semver"
            },
            {
              "lessThan": "4.6",
              "status": "affected",
              "version": "4.5.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.161",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.121",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.66",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: always detect conflicting inodes when logging inode refs\n\nAfter rename exchanging (either with the rename exchange operation or\nregular renames in multiple non-atomic steps) two inodes and at least\none of them is a directory, we can end up with a log tree that contains\nonly of the inodes and after a power failure that can result in an attempt\nto delete the other inode when it should not because it was not deleted\nbefore the power failure. In some case that delete attempt fails when\nthe target inode is a directory that contains a subvolume inside it, since\nthe log replay code is not prepared to deal with directory entries that\npoint to root items (only inode items).\n\n1) We have directories \"dir1\" (inode A) and \"dir2\" (inode B) under the\n   same parent directory;\n\n2) We have a file (inode C) under directory \"dir1\" (inode A);\n\n3) We have a subvolume inside directory \"dir2\" (inode B);\n\n4) All these inodes were persisted in a past transaction and we are\n   currently at transaction N;\n\n5) We rename the file (inode C), so at btrfs_log_new_name() we update\n   inode C\u0027s last_unlink_trans to N;\n\n6) We get a rename exchange for \"dir1\" (inode A) and \"dir2\" (inode B),\n   so after the exchange \"dir1\" is inode B and \"dir2\" is inode A.\n   During the rename exchange we call btrfs_log_new_name() for inodes\n   A and B, but because they are directories, we don\u0027t update their\n   last_unlink_trans to N;\n\n7) An fsync against the file (inode C) is done, and because its inode\n   has a last_unlink_trans with a value of N we log its parent directory\n   (inode A) (through btrfs_log_all_parents(), called from\n   btrfs_log_inode_parent()).\n\n8) So we end up with inode B not logged, which now has the old name\n   of inode A. At copy_inode_items_to_log(), when logging inode A, we\n   did not check if we had any conflicting inode to log because inode\n   A has a generation lower than the current transaction (created in\n   a past transaction);\n\n9) After a power failure, when replaying the log tree, since we find that\n   inode A has a new name that conflicts with the name of inode B in the\n   fs tree, we attempt to delete inode B... this is wrong since that\n   directory was never deleted before the power failure, and because there\n   is a subvolume inside that directory, attempting to delete it will fail\n   since replay_dir_deletes() and btrfs_unlink_inode() are not prepared\n   to deal with dir items that point to roots instead of inodes.\n\n   When that happens the mount fails and we get a stack trace like the\n   following:\n\n   [87.2314] BTRFS info (device dm-0): start tree-log replay\n   [87.2318] BTRFS critical (device dm-0): failed to delete reference to subvol, root 5 inode 256 parent 259\n   [87.2332] ------------[ cut here ]------------\n   [87.2338] BTRFS: Transaction aborted (error -2)\n   [87.2346] WARNING: CPU: 1 PID: 638968 at fs/btrfs/inode.c:4345 __btrfs_unlink_inode+0x416/0x440 [btrfs]\n   [87.2368] Modules linked in: btrfs loop dm_thin_pool (...)\n   [87.2470] CPU: 1 UID: 0 PID: 638968 Comm: mount Tainted: G        W           6.18.0-rc7-btrfs-next-218+ #2 PREEMPT(full)\n   [87.2489] Tainted: [W]=WARN\n   [87.2494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n   [87.2514] RIP: 0010:__btrfs_unlink_inode+0x416/0x440 [btrfs]\n   [87.2538] Code: c0 89 04 24 (...)\n   [87.2568] RSP: 0018:ffffc0e741f4b9b8 EFLAGS: 00010286\n   [87.2574] RAX: 0000000000000000 RBX: ffff9d3ec8a6cf60 RCX: 0000000000000000\n   [87.2582] RDX: 0000000000000002 RSI: ffffffff84ab45a1 RDI: 00000000ffffffff\n   [87.2591] RBP: ffff9d3ec8a6ef20 R08: 0000000000000000 R09: ffffc0e741f4b840\n   [87.2599] R10: ffff9d45dc1fffa8 R11: 0000000000000003 R12: ffff9d3ee26d77e0\n   [87.2608] R13: ffffc0e741f4ba98 R14: ffff9d4458040800 R15: ffff9d44b6b7ca10\n   [87.2618] FS:  00007f7b9603a840(0000) GS:ffff9d4658982000(0000) knlGS:0000000000000000\n   [87.\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote attacker can reach the Btrfs rename and fsync paths through a Btrfs-backed writable ksmbd share using SMB2 RENAME and FLUSH requests. Multiple ordinary renames can perform the required exchange without RENAME_EXCHANGE support.\nAC:L - The attacker controls the complete rename and fsync sequence, with no race, heap layout, or probabilistic memory condition to overcome. The state can be recreated repeatedly so it remains pending when an unclean shutdown occurs.\nPR:N - ksmbd supports unauthenticated guest sessions, making the sequence reachable without credentials on a guest-writable share. No Linux capability is checked after the guest has ordinary delete and write access to the shared directory.\nUI:N - No victim action is required while the attacker constructs and persists the inconsistent log. Log replay normally occurs automatically during the next boot or mount after an unclean shutdown.\nS:U - The vulnerable logging and recovery operations affect resources managed by the same host kernel and Btrfs filesystem. No virtualization, IOMMU, or other security-authority boundary is crossed.\nC:N - The flaw neither reads attacker-selected memory nor discloses filesystem or kernel data. The affected paths contain no use-after-free, out-of-bounds access, or other memory-corruption primitive.\nI:H - Replay can incorrectly unlink a legitimate conflicting directory and recursively orphan its ordinary contents, allowing severe filesystem data loss. The attacker controls the conflicting names and inode arrangement used by replay.\nA:H - If the wrongly removed directory contains a subvolume, replay aborts its transaction and the entire Btrfs filesystem fails to mount. This makes all data and services dependent on that filesystem unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:28.400Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7f0207db68d5a1b4af23acbef1a8e8ddc431ebb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a63998cd6687c14b160dccb0bbcf281b2eb0dab3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c2413c69129f6ce60157f7b53d9ba880260400b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d52af58dd463821c5c516aebb031a58934f696ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ba0b6461bc4edb3005ea6e00cdae189bcf908a5"
        }
      ],
      "title": "btrfs: always detect conflicting inodes when logging inode refs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71183",
    "datePublished": "2026-01-31T11:38:56.067Z",
    "dateReserved": "2026-01-31T11:36:51.186Z",
    "dateUpdated": "2026-10-19T18:15:16.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72041",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:50:34.375706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-664",
                "description": "CWE-664 Improper Control of a Resource Through its Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:24.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "518dcb84b997dff461800b079e5f2596389f766a",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "4ea8c051b4bd7feec7749a980f2f70e1782b84d7",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "a977f78adce40b39d90d9567e7987bb110102810",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "54d73f18f8919735f4d04d6f43374f75756c0180",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "14c0b42c8a2cd9b5361bbff45b52f69c62c6a286",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "a66d45e0ce6d73cd79962d422388e61bfaf0cb50",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "007800408002d871f5699bdb944f985896730b8f",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: use sk_msg_free_partial to fix partial send\n\nsk_msg_free_partial() ensures consistency of the skmsg at every\niteration, without having to manually handle uncharges and offsets.\nThis simplifies the code, and fixes some bugs in skmsg accounting when\nwe don\u0027t send the full contents."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - espintcp carries IKE/IPsec over TCP (RFC 8229) on internet-facing VPN gateways; a remote TCP peer can induce partial sends during server outbound IKE responses by shrinking/draining the receive window, corrupting skmsg state without local access.\nAC:L - The attacker controls both sides of the TCP connection and can reliably force partial sends by not reading, advertising a zero window, or resetting mid-transfer; no race or memory-layout conditions outside attacker control are required.\nPR:N - Exploitation needs no credentials on the target\u2014an unauthenticated remote peer during pre-auth IKE-over-TCP can trigger server sends; locally any user can set TCP_ULP to espintcp and sendmsg without CAP_NET_ADMIN or XFRM configuration.\nUI:N - No victim user action is required; once an espintcp TCP endpoint exists, the remote peer alone drives the partial-send condition through normal TCP flow control during server transmission.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel; it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Incorrect skmsg/page accounting on partial sends causes use-after-free and double-free of scatterlist pages; freed objects can be reallocated and read for arbitrary kernel memory disclosure.\nI:H - Corrupted scatterlist offsets and page refcount errors yield exploitable kernel memory corruption primitives that can enable arbitrary writes and local privilege escalation.\nA:H - Double-free and invalid page references in the send/resume path can oops or panic the kernel; a remote or local attacker can repeat the trigger via sustained partial-send pressure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:32.051Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810"
        },
        {
          "url": "https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180"
        },
        {
          "url": "https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286"
        },
        {
          "url": "https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714"
        },
        {
          "url": "https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f"
        }
      ],
      "title": "espintcp: use sk_msg_free_partial to fix partial send",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72041",
    "datePublished": "2026-08-15T05:52:00.721Z",
    "dateReserved": "2026-08-09T03:40:39.901Z",
    "dateUpdated": "2026-10-19T21:19:24.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:50:52.967716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:26.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "lessThan": "b422e3eff0edf0975de4883929adbed28f9d08bc",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "lessThan": "2fface6e0bbd6314d1d9d071abf2c4d67548511c",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "lessThan": "46762cefe7f4e5bffc1eb467810a7bbb02e461d7",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "78b6803a1961369d0b8350ff1f99b7375bbd7a8f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5d73d9cdd6be22795499890ea928a6f57ef829c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6533fed1bfa842e391ee50f9a9c5e963c71e579",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2095ab2456da766174cda8bc105d7a7b1bc70e16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1fdb184aefa8447560e3ea0e605171592ffee41",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f75c8a3015422128ca150e81c730bc2a471b5f4a",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.71",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.111",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.48",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.54",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.22",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.71",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: serialize netif_running() check in enqueue_to_backlog()\n\nSyzbot reported a KASAN slab-use-after-free in fib_rules_lookup().\n\nThe root cause is a race condition where packets can escape the backlog\nflushing during device unregistration (e.g., during netns exit).\n\nCommit e9e4dd3267d0 (\"net: do not process device backlog during unregistration\")\nintroduced a lockless netif_running() check in enqueue_to_backlog() to\nprevent queuing packets to an unregistering device.\n\nHowever, this creates a TOCTOU race window.\n\nA lockless transmitter (like veth_xmit) can pass\nthe check before dev_close() clears IFF_UP. If the transmitter is then\ndelayed, flush_all_backlogs() can run and finish before the transmitter\ngrabs the backlog lock and queues the packet. The packet then escapes\nthe flush and triggers UAF later when processed.\n\nFix this by moving the netif_running() check inside the backlog lock.\nThis serializes the check with the flush work (which also grabs the lock).\nWe then either queue the packet before the flush runs (so it gets flushed),\nor check netif_running() after the flush/close completes (so it gets dropped)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the generic per-CPU backlog receive path (`netif_rx`/`netif_receive_skb` -\u003e `enqueue_to_backlog`); packets can originate from remote peers reaching veth/bridge/NIC interfaces, and syzbot reproduced it via network transmit/receive activity during device unregistration.\nAC:L - The attacker controls both racing sides by concurrently flooding packets through a lockless transmitter (e.g. veth) while unregistering the device/netns (e.g. `ip link del` or netns exit); no victim-specific timing or memory layout is required beyond repeatable parallel traffic and teardown.\nPR:L - Triggering veth creation, traffic injection, and netdev/netns teardown requires only `CAP_NET_ADMIN` inside a network namespace, obtainable by an unprivileged local user via user namespaces (`unshare -Urn`); init-namespace root is not required.\nUI:N - Exploitation needs only the attacker\u0027s own concurrent packet transmission and interface/netns teardown; no independent action by another user or administrator is required at trigger time.\nS:C - The use-after-free is triggered from within an isolated network namespace yet corrupts host-global kernel routing state (`fib_rules_lookup` on freed namespace/rule data), crossing the container/netns security boundary into the host kernel\u0027s integrity and availability.\nC:H - KASAN reported slab-use-after-free in `fib_rules_lookup()` walking `net-\u003erules_ops`; freed namespace/device-associated structures can be reallocated and read through stale pointers, yielding an attacker-influenceable kernel memory read/disclosure primitive.\nI:H - Processing the escaped backlog skb invokes routing through freed `fib_rules_ops` and indirect function pointers (`ops-\u003ematch`/`ops-\u003eaction`); UAF on these heap objects enables heap grooming, control-flow hijack, and arbitrary kernel write leading to privilege escalation.\nA:H - Confirmed slab-use-after-free in core packet processing during device unregistration reliably causes kernel oops/panic (syzbot KASAN splat in `fib_rules_lookup()`), and repeated triggering can deny service to the entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:45:02.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b422e3eff0edf0975de4883929adbed28f9d08bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fface6e0bbd6314d1d9d071abf2c4d67548511c"
        },
        {
          "url": "https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"
        }
      ],
      "title": "net: serialize netif_running() check in enqueue_to_backlog()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72493",
    "datePublished": "2026-08-15T05:57:27.642Z",
    "dateReserved": "2026-08-09T03:40:39.937Z",
    "dateUpdated": "2026-10-21T12:45:02.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:00:58.726885Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:57.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf09b0be8e851f050e98da702d247c14d81b591a",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "73dd3bf704ca6c20639de70c08e9a10bee904a95",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "f1a87ca0843d74482402a206ea2dfb315ee9acbd",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "60eafc7b08c6689ea3ad39eff8d97aefc8a087c7",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "d7860b682da55433b5da0591b0e4c1982ecd2689",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "b05defc41b27c7d0c05c45f67bf5b91c28f93669",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "fcc77d33a34cf271702e8daafb6c593e4626776d",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\n\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\ndirectly into the skcipher request. After io_submit() the socket lock is\ndropped and the request is processed asynchronously, so a concurrent\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\nrun under an attacker-controlled IV. For CTR/stream modes this is\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\na concurrent operation.\n\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\naf_alg_free_resources() releases on completion, silently producing wrong\noutput. Writing the IV back from the completion callback instead is not\npossible either: that would require lock_sock() there, but the callback can\nrun in softirq/atomic context, so it must not sleep.\n\nMake the operation synchronous instead, which removes both the IV race and\nany writeback race. This is equivalent to the upstream resolution, commit\nfcc77d33a34c (\"net: Remove support for AIO on sockets\"), which removed the\nAIO socket path across net/ entirely and so produces the same end state for\nthis file. This patch deviates from that commit deliberately: rather than\nremoving AIO socket support tree-wide, which would be far too invasive for\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\nio_submit() now completes synchronously; AF_ALG async is rarely used in\npractice.\n\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\nand is left alone to keep the fix minimal.\n\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls on an AF_ALG skcipher socket (socket/bind/accept/sendmsg plus async recvmsg, io_submit, aio_read, or io_uring read); the bug is not reachable from remote network protocols.\nAC:L - The attacker fully controls the race by running concurrent threads or syscalls on the same socket, timing async recvmsg/io_submit against sendmsg(ALG_SET_IV); pre-fix testing achieved thousands of successful IV injections in 200000 attempts.\nPR:L - Any unprivileged local user can create and use AF_ALG skcipher sockets without CAP_NET_ADMIN or init-namespace root; only standard UNIX discretionary access to the target socket FD is required, which includes same-UID multi-threaded processes.\nUI:N - Exploitation is fully attacker-driven through direct syscalls and requires no victim interaction such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to cryptographic operations on the compromised AF_ALG socket within the attacker\u0027s security context; it does not cross VM, container, or kernel-user authority boundaries like KVM escape or IOMMU bypass.\nC:H - Concurrent IV injection on CTR/stream ciphers causes keystream reuse, letting an attacker recover the full plaintext of an in-flight decrypt/encrypt on the same keyed socket even when the key never leaves kernel memory.\nI:H - Attacker-controlled IV injection corrupts in-flight cipher output and breaks MSG_MORE CBC/CTR chaining (statesize==0), silently producing attacker-influenced ciphertext/plaintext and undermining cryptographic integrity of concurrent operations.\nA:N - The flaw causes information disclosure and silent cryptographic corruption but does not kernel panic, oops, hang, or reliably deny service; availability impact is none beyond possible application-level misbehavior."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:57.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf09b0be8e851f050e98da702d247c14d81b591a"
        },
        {
          "url": "https://git.kernel.org/stable/c/73dd3bf704ca6c20639de70c08e9a10bee904a95"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1a87ca0843d74482402a206ea2dfb315ee9acbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/60eafc7b08c6689ea3ad39eff8d97aefc8a087c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7860b682da55433b5da0591b0e4c1982ecd2689"
        },
        {
          "url": "https://git.kernel.org/stable/c/b05defc41b27c7d0c05c45f67bf5b91c28f93669"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcc77d33a34cf271702e8daafb6c593e4626776d"
        }
      ],
      "title": "crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74578",
    "datePublished": "2026-08-16T08:20:32.055Z",
    "dateReserved": "2026-08-15T05:44:03.917Z",
    "dateUpdated": "2026-10-16T19:05:57.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74587",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:01:25.161847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:58.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c",
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10459b03e2d9ee12435e96f587de4d4cacdbf435",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "e1bb114e09372fd6e03387ced9ef566da336ed6c",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "179676f0166230c80053a392303485b37c93dd33",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "618b5c6d049896fcfabb91afc072954c92cb2693",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "07daf4f9750104960a1d60831b2353c0d41f35fb",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "d949992bc3f00027a2c755e860a11950c75f6073",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "8c283e7b56adce00193837f3311b06662466fb21",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c",
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is triggered when the kernel processes inbound SCTP COOKIE-ECHO (peer restart) and ASCONF-ACK chunks from a remote association peer via sctp_rcv()/sctp_inq_push()/sctp_do_sm(), with no local syscall required on the victim.\nAC:L - The remote SCTP peer controls the full protocol sequence\u2014establishing an ADDIP-capable association, waiting for the victim\u0027s outstanding ASCONF, sending COOKIE-ECHO restart to purge queues, then delivering a delayed authenticated ASCONF-ACK\u2014without attacker-uncontrollable races or memory layout.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted COOKIE-ECHO and ASCONF-ACK packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - sctp_sf_do_asconf_ack() and sctp_process_asconf_ack() dereference the stale addip_last_asconf pointer to read freed sctp_chunk and skb metadata; UAF on slab-allocated chunk objects enables heap grooming for arbitrary kernel memory disclosure.\nI:H - The stale pointer causes sctp_process_asconf_ack() to perform a second sctp_chunk_free() on an already-freed chunk, yielding a kmem_cache double-free that can be leveraged for arbitrary kernel write or control-flow hijack.\nA:H - Dereferencing the freed cached ASCONF chunk during ASCONF-ACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:13.798Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693"
        },
        {
          "url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21"
        }
      ],
      "title": "sctp: fix use-after-free of cached ASCONF chunk",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74587",
    "datePublished": "2026-08-22T15:31:39.810Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-10-16T19:05:58.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74611",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:02:18.342764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:06:01.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c",
            "tools/testing/selftests/net/tls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97004f3c17371ee1b259887298711e0604666688",
              "status": "affected",
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "versionType": "git"
            },
            {
              "lessThan": "c71bacacd59166adbea423a04e7474b0e8245b84",
              "status": "affected",
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "versionType": "git"
            },
            {
              "lessThan": "3c4e21b1bf8e666a1c141e0f5813ece929570deb",
              "status": "affected",
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "versionType": "git"
            },
            {
              "lessThan": "68787940274ec89f41dc91b1a68ee1a16a90735f",
              "status": "affected",
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "versionType": "git"
            },
            {
              "lessThan": "3c837266a734e2a22b24d2d567404a501d405835",
              "status": "affected",
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "versionType": "git"
            },
            {
              "lessThan": "1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e",
              "status": "affected",
              "version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c",
            "tools/testing/selftests/net/tls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: rx: restore msg_iter before TLS 1.3 optimistic retry\n\ntls_decrypt_sg() advances msg-\u003emsg_iter when it maps user pages for\nthe optimistic TLS 1.3 zero-copy path. If the decrypted record turns\nout not to be unpadded application data, tls_decrypt_sw() retries into\na kernel skb, but leaves the iterator advanced.\n\nThe subsequent copy from the skb then writes decrypted bytes again at\na later point in the caller iovecs while recvmsg() reports only the\npost-retry length. A TLS peer can trigger this after the receiver\nenables TLS_RX_EXPECT_NO_PAD.\n\nRevert the iterator by the number of bytes consumed by the optimistic\nmapping before retrying without zero-copy.\n\nAdd a selftest which sends a TLS 1.3 control record with\nTLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not\noverwrite later iovecs beyond the returned length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in kTLS software RX (tls_decrypt_sw/tls_sw_recvmsg) and is driven by TLS 1.3 records received from a remote TCP peer; per kernel CNA guidance, kTLS flaws triggered by peer ciphertext on an established connection are Network-reachable (e.g., malicious client to nginx/HAProxy/NVMe-oF-TLS server).\nAC:L - Once the receiver has TLS 1.3 kTLS RX with TLS_RX_EXPECT_NO_PAD, a remote peer can deterministically trigger the optimistic-decrypt retry by sending a non-application-data inner record (handshake/alert/KeyUpdate) or padded data; no race, special heap layout, or rare kernel build is required.\nPR:N - Exploitation requires only being the remote TLS peer on an established kTLS connection; the attacker needs no credentials or Linux capabilities on the victim host. TLS_RX_EXPECT_NO_PAD is a receiver-side performance option set by the service, not an attacker privilege gate.\nUI:N - No victim user action beyond normal automated server operation (maintaining a TLS session and calling recvmsg on kTLS sockets). The attacker triggers the flaw solely by sending protocol-valid TLS records over the network.\nS:U - The out-of-bounds write corrupts user-space iovec buffers of the process owning the kTLS socket within the same security authority; it does not cross a VM, IOMMU, or sandbox boundary to another security domain.\nC:H - skb_copy_datagram_msg writes decrypted peer-controlled bytes past the recvmsg-reported length into adjacent user buffers. This memory corruption can be leveraged for information disclosure via heap/stack grooming even though the immediate primitive is a write.\nI:H - The remote peer controls the decrypted payload written out-of-bounds (up to a full TLS record, roughly 16 KiB) into later iovecs while recvmsg under-reports bytes copied, giving a reliable user-space memory corruption primitive suitable for control-flow or data hijack in privileged daemons.\nA:H - Corrupting adjacent application buffers in kTLS-enabled daemons (web proxies, storage targets, RPC endpoints) can crash workers or destabilize the service; the silent mismatch between returned length and bytes written also enables persistent denial of service on long-lived connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:30:14.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97004f3c17371ee1b259887298711e0604666688"
        },
        {
          "url": "https://git.kernel.org/stable/c/c71bacacd59166adbea423a04e7474b0e8245b84"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c4e21b1bf8e666a1c141e0f5813ece929570deb"
        },
        {
          "url": "https://git.kernel.org/stable/c/68787940274ec89f41dc91b1a68ee1a16a90735f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c837266a734e2a22b24d2d567404a501d405835"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e"
        }
      ],
      "title": "tls: rx: restore msg_iter before TLS 1.3 optimistic retry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74611",
    "datePublished": "2026-08-22T15:31:57.534Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-10-30T12:30:14.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:02:43.340591Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:06:02.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto.c",
            "net/netfilter/nf_conntrack_proto_sctp.c",
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca97360eba4b3dc67f1804625542f4ccc774242a",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "63853eb20bba4e00b7cd0b8cfc19337bbaaf5037",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "9480fcf70a5aa9d320088a01c95df0e5e6391f4a",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "0424186d570aa4d1ad17f516afb86bd9eaa4f42e",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "c0224327b7cbed9d3198e8dbec847281053dcd06",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "2d19b95c9723001f214f7a47d67b09f46238f200",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto.c",
            "net/netfilter/nf_conntrack_proto_sctp.c",
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct-\u003elock\nis still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is\nenabled, the log path can re-enter conntrack netlink glue and dump the\nsame conntrack again. Protocol attribute dumping may take ct-\u003elock, so\nlogging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while\nct-\u003elock is held and emitting the log after unlocking. Also make the TCP\ntimeout-lowering invalid path return whether a log is needed, then emit\nthat log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached\nwhile ct-\u003elock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers\nthat log invalid conntracks while holding ct-\u003elock are caught outside TCP\nand SCTP as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is hit in nf_conntrack_tcp_packet()/nf_conntrack_sctp_packet() from the NF_INET_PRE_ROUTING and LOCAL_OUT netfilter hooks on received or forwarded TCP/SCTP traffic, so a remote peer can trigger invalid conntrack handling with crafted packets to internet-facing NAT gateways, routers, and servers.\nAC:L - Once nf_conntrack_log_invalid, nflog binding, and NFULNL_CFG_F_CONNTRACK are enabled (the CVE-scoped configuration on monitored firewalls), an attacker deterministically deadlocks by sending invalid-sequence TCP or invalid-state SCTP packets on tracked flows without races or special memory layout.\nPR:N - Triggering the vulnerable conntrack path requires only the ability to send TCP/SCTP packets to a host already running connection tracking with invalid logging; no local account, CAP_NET_ADMIN, or netlink configuration privileges are needed on the attacker side.\nUI:N - Exploitation is driven entirely by network packet delivery and softirq packet processing; no victim must open files, mount filesystems, or perform any interactive action beyond normal network connectivity to the target.\nS:U - The deadlock confines impact to the same kernel networking authority processing the packet; it does not cross VM, container, or IOMMU boundaries to compromise a separate security domain.\nC:N - This is a recursive spinlock deadlock in conntrack invalid logging with no memory corruption, out-of-bounds access, use-after-free, or information-disclosure primitive.\nI:N - The bug causes a lock re-entry hang during logging only; it does not modify kernel or user data, provide arbitrary write primitives, or enable code execution.\nA:H - Re-acquiring ct-\u003elock while it is held deadlocks packet processing on the affected CPU in softirq context, can stall networking on that core, and may escalate to soft lockup or watchdog-induced kernel panic under sustained attack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:47.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca97360eba4b3dc67f1804625542f4ccc774242a"
        },
        {
          "url": "https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037"
        },
        {
          "url": "https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200"
        }
      ],
      "title": "netfilter: nf_conntrack: defer invalid log until after unlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74624",
    "datePublished": "2026-08-22T15:32:07.193Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-10-16T19:06:02.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80977",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:21:39.834701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:37.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6493165034bca14033bf49c9cec7b45e97a91497",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "b4452349dcf4d561e13be768d5d278de58248930",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "363c4252ffc473a0203e91b83ede5519dfb8bd07",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "6ec22afc82a3cae07ade0a6ec361ae2532128ff5",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "15aa81b390d401abf4b8211042470e9e92e3b7fb",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "288f9970670841044ab030104fa6b6ed159949d0",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "0370da114a9bc044e248b85c6809d1b5e0c1f7f9",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "f66bdb1cc0fcd227a062378f8be0b5873aa5600a",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone\nshares, while the caller only owns the reference it is about to drop.\nThrough a clone it tells the producer its pages are free and drops\nSKBFL_SHARED_FRAG for an skb that is still in flight.\n\nOpen vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone()\ndoes not privatise the frags here -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker\nfrom the packet still being forwarded, and a later local ESP delivery\ndecrypts in place over frags it does not own privately.\n\nSkip it for a cloned skb. Nothing is lost: skb_release_data() clears\nthe zerocopy state once the last reference to the shared data goes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The buggy state is a locally originated MSG_ZEROCOPY/io_uring TX skb (SKBFL_DONT_ORPHAN plus a uarg); NIC-received packets never carry that marker, and the skb must still be forwarded into local ESP, so a local account is required.\nAC:L - The attacker fully controls both sides: OVS flows with a non-last RECIRC, a guaranteed miss/upcall failure on the clone, MSG_ZEROCOPY send, and the ESP SA/payload, so the shared-shinfo strip and in-place decrypt are reliably reproducible with no race beyond attacker influence.\nPR:L - An unprivileged user can enable SO_ZEROCOPY and, via unshare -Urn, obtain CAP_NET_ADMIN in a user+net namespace; OVS genetlink uses GENL_UNS_ADMIN_PERM and XFRM SAs are likewise namespace-installable, while the global page cache remains the corruption target.\nUI:N - The attacker installs the OVS recirc flow, sends the MSG_ZEROCOPY packet, and completes local ESP delivery without any victim action.\nS:U - The resulting page-cache write and premature zerocopy completion stay inside the host kernel\u0027s memory authority as a standard local memory-corruption/LPE primitive and do not cross a VM or IOMMU boundary.\nC:H - skb_tx_error() on the clone completes the shared uarg and clears SKBFL_SHARED_FRAG, so later in-place ESP decrypt (and UAF of still-mapped pages) corrupts globally cached file/code pages and can be leveraged for arbitrary disclosure.\nI:H - With the shared-frag marker stripped, esp_input() skips skb_cow_data() and AEAD-decrypts attacker-controlled plaintext in place over page-cache-backed frags, yielding an unprivileged write into files the sender could only read (the Fragnesia primitive).\nA:H - Use-after-free of zerocopy pages still referenced by the in-flight original skb, plus overwriting page-cache-backed executable or kernel-managed data, causes oopses, panics, and process crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:46:01.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6493165034bca14033bf49c9cec7b45e97a91497"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4452349dcf4d561e13be768d5d278de58248930"
        },
        {
          "url": "https://git.kernel.org/stable/c/363c4252ffc473a0203e91b83ede5519dfb8bd07"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ec22afc82a3cae07ade0a6ec361ae2532128ff5"
        },
        {
          "url": "https://git.kernel.org/stable/c/15aa81b390d401abf4b8211042470e9e92e3b7fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/288f9970670841044ab030104fa6b6ed159949d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/0370da114a9bc044e248b85c6809d1b5e0c1f7f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f66bdb1cc0fcd227a062378f8be0b5873aa5600a"
        }
      ],
      "title": "net: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80977",
    "datePublished": "2026-09-11T19:42:38.862Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-10-19T08:46:01.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89528",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:02.453234Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:41.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08aa4162df91880a79be744aaa9570b04d4875c4",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "beb4e9801f6362436102acc4cc5304b7324f9365",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "e70fdb121171c3eb0ac34eb545721828cd737717",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "1a3af2262cb384112ef38632de4690682be528b4",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "465f511f59a0fa7a80d5d1073c4b24f28ea38f58",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "0ca487abb3bdf581851664b5db21f364caf57682",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Read lists that exceed the page budget\n\nIndividual Read segment lengths are validated at decode time, but\nnothing prevents a requester from sending multiple segments whose\ncumulative length exceeds the rq_pages array budget. When one\nsegment fills the page array exactly, the runtime guard in\nsvc_rdma_build_read_segment() is bypassed because len reaches zero.\nA subsequent segment then accesses the NULL sentinel slot at\nrq_pages[rq_maxpages], resulting in a NULL pointer dereference during\nDMA mapping.\n\nAccumulate pages across all Read segments and reject the message at\ndecode time when the total would overflow the page budget."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote peer reaches svc_rdma_recvfrom() by sending a Call with a Read list on an enabled NFS/RDMA listener over routable RoCEv2 or iWARP.\nAC:L - The attacker fully controls Read-segment lengths in the transport header and can deterministically fill rq_pages exactly, then send a further segment so the len==0 overrun guard is skipped and the NULL sentinel is DMA-mapped, with no race or uncontrollable layout.\nPR:N - xdr_count_read_segments() and svc_rdma_build_read_segment() run in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.\nUI:N - Sending a crafted RPC-over-RDMA message with an over-budget Read list is sufficient; no victim mount, click, or other user action is required.\nS:U - The NULL dereference oops stays in the host kernel that owns nfsd/svcrdma; this is not a VM, IOMMU, or sandbox escape.\nC:N - The fault is a NULL pointer dereference of the rq_pages[rq_maxpages] sentinel during DMA mapping; the access faults immediately and does not disclose kernel memory.\nI:N - The sentinel slot is a guaranteed NULL page pointer, not an out-of-bounds page used as a write destination; DMA mapping aborts on the NULL page without an arbitrary-write or control-flow hijack primitive.\nA:H - DMA mapping the NULL sentinel produces a kernel oops or panic that an unauthenticated NFS/RDMA peer can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:32:00.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08aa4162df91880a79be744aaa9570b04d4875c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/beb4e9801f6362436102acc4cc5304b7324f9365"
        },
        {
          "url": "https://git.kernel.org/stable/c/e70fdb121171c3eb0ac34eb545721828cd737717"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682"
        }
      ],
      "title": "svcrdma: Reject Read lists that exceed the page budget",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89528",
    "datePublished": "2026-09-11T19:44:08.514Z",
    "dateReserved": "2026-09-11T19:38:34.719Z",
    "dateUpdated": "2026-10-30T12:32:00.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "863b6e995665472f2af5be2436a874ab6a9e5ac6",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "d18d36395d973ef7372c8e6724970585f75b5c0b",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "4415a692346a39fdb647cbd717eda510159aaf55",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "9caad13b7cfe9ccb90cc405ac77335800e086595",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "e08a3dcaca0505f861e344a387f37f94d95dbdc2",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "a4d7fedcaaf33e60a01e53eafca9041ef966212f",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            },
            {
              "lessThan": "129643893b79f8a3c6b72045f933fbab5ee424ca",
              "status": "affected",
              "version": "624322f1adc58acd0b69f77a6ddc764207e97241",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize copy-notify stateid before publishing it\n\nnfsd4_copy_notify() finished initializing the cpntf state after\nnfs4_alloc_init_cpntf_state() had already linked it into the\ns2s_cp_stateids IDR and the parent\u0027s sc_cp_list, with cs_count == 1 (the\nmembership reference) and none held for the caller. A racing\nOFFLOAD_CANCEL (crafted cl_id == nn-\u003es2s_cp_cl_id plus the guessable\nso_id) could reach manage_cpntf_state() and free the entry, turning the\ncaller\u0027s subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid\nwrites into use-after-free. The owning clientid was also only recorded\nafter publication, so it could not gate an ownership check in that window.\n\nRecord cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()\nbefore nfs4_init_cp_state() publishes the entry, and return it with an\nextra reference. The caller reads the stateid under that reference and\ndrops it with nfs4_put_cpntf_state(); on a late error the laundromat\nreaps the entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is in nfsd COPY_NOTIFY (nfsd4_copy_notify/nfs4_alloc_init_cpntf_state). NFSv4.2 COPY_NOTIFY and a racing OFFLOAD_CANCEL are processed from compounds over TCP/2049 via nfsd4_proc_compound, so a remote NFS client reaches the published cpntf object over the network.\nAC:L - The attacker controls both sides: one compound publishes the cpntf IDR entry via COPY_NOTIFY while a concurrent OFFLOAD_CANCEL uses the leaked nn-\u003es2s_cp_cl_id and a cyclic guessable so_id to kfree it before initialization finishes; the race is retryable on multiple session slots with no condition outside attacker control.\nPR:N - Default AUTH_SYS/AUTH_NULL nfsd exports do no cryptographic authentication; any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION, OPEN a readable file, and issue COPY_NOTIFY and OFFLOAD_CANCEL. No local account or capability on the NFS server is required.\nUI:N - The attacking NFS client drives COPY_NOTIFY and the concurrent OFFLOAD_CANCEL on its own connections; no victim user or administrator action on the NFS server is required at attack time.\nS:U - The use-after-free corrupts a kmalloc\u0027d nfs4_cpntf_state in the host kernel\u0027s nfsd copy-notify tables. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After OFFLOAD_CANCEL kfree\u0027s the object (cs_count was 1), nfsd4_copy_notify memcpy\u0027s the freed cp_stateid.cs_stid into the RPC reply; reclaim of that kmalloc slab lets the attacker disclose kernel memory. Per kernel guidance a use-after-free is C:H.\nI:H - The same path then writes cp_p_stateid and cp_p_clid into the freed nfs4_cpntf_state, a use-after-free write primitive usable for heap corruption and control-flow hijacking. Per kernel guidance a use-after-free is I:H.\nA:H - Use-after-free of nfs4_cpntf_state in an nfsd worker oopses or panics the NFS server even without full exploitation, and the attacker can repeat the concurrent RPC sequence to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:50:42.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/863b6e995665472f2af5be2436a874ab6a9e5ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18d36395d973ef7372c8e6724970585f75b5c0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4415a692346a39fdb647cbd717eda510159aaf55"
        },
        {
          "url": "https://git.kernel.org/stable/c/9caad13b7cfe9ccb90cc405ac77335800e086595"
        },
        {
          "url": "https://git.kernel.org/stable/c/e08a3dcaca0505f861e344a387f37f94d95dbdc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4d7fedcaaf33e60a01e53eafca9041ef966212f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cdef96892f4fa6e70c405b6e8f2fd6972f3b64b"
        },
        {
          "url": "https://git.kernel.org/stable/c/129643893b79f8a3c6b72045f933fbab5ee424ca"
        }
      ],
      "title": "nfsd: initialize copy-notify stateid before publishing it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89669",
    "datePublished": "2026-09-11T19:45:55.111Z",
    "dateReserved": "2026-09-11T19:38:34.746Z",
    "dateUpdated": "2026-10-19T08:50:42.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}