{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72041",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:50:34.375706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-664",
                "description": "CWE-664 Improper Control of a Resource Through its Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:24.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "518dcb84b997dff461800b079e5f2596389f766a",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "4ea8c051b4bd7feec7749a980f2f70e1782b84d7",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "a977f78adce40b39d90d9567e7987bb110102810",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "54d73f18f8919735f4d04d6f43374f75756c0180",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "14c0b42c8a2cd9b5361bbff45b52f69c62c6a286",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "a66d45e0ce6d73cd79962d422388e61bfaf0cb50",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "007800408002d871f5699bdb944f985896730b8f",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: use sk_msg_free_partial to fix partial send\n\nsk_msg_free_partial() ensures consistency of the skmsg at every\niteration, without having to manually handle uncharges and offsets.\nThis simplifies the code, and fixes some bugs in skmsg accounting when\nwe don\u0027t send the full contents."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - espintcp carries IKE/IPsec over TCP (RFC 8229) on internet-facing VPN gateways; a remote TCP peer can induce partial sends during server outbound IKE responses by shrinking/draining the receive window, corrupting skmsg state without local access.\nAC:L - The attacker controls both sides of the TCP connection and can reliably force partial sends by not reading, advertising a zero window, or resetting mid-transfer; no race or memory-layout conditions outside attacker control are required.\nPR:N - Exploitation needs no credentials on the target\u2014an unauthenticated remote peer during pre-auth IKE-over-TCP can trigger server sends; locally any user can set TCP_ULP to espintcp and sendmsg without CAP_NET_ADMIN or XFRM configuration.\nUI:N - No victim user action is required; once an espintcp TCP endpoint exists, the remote peer alone drives the partial-send condition through normal TCP flow control during server transmission.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel; it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Incorrect skmsg/page accounting on partial sends causes use-after-free and double-free of scatterlist pages; freed objects can be reallocated and read for arbitrary kernel memory disclosure.\nI:H - Corrupted scatterlist offsets and page refcount errors yield exploitable kernel memory corruption primitives that can enable arbitrary writes and local privilege escalation.\nA:H - Double-free and invalid page references in the send/resume path can oops or panic the kernel; a remote or local attacker can repeat the trigger via sustained partial-send pressure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:32.051Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810"
        },
        {
          "url": "https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180"
        },
        {
          "url": "https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286"
        },
        {
          "url": "https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714"
        },
        {
          "url": "https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f"
        }
      ],
      "title": "espintcp: use sk_msg_free_partial to fix partial send",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72041",
    "datePublished": "2026-08-15T05:52:00.721Z",
    "dateReserved": "2026-08-09T03:40:39.901Z",
    "dateUpdated": "2026-10-19T21:19:24.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72110",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:41:35.831908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:44:56.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7df67a4799067a59e6a2d53f8059a6be6e73e678",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            },
            {
              "lessThan": "aff686efd38728e06daf12417a0d7ed454ce4cff",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            },
            {
              "lessThan": "c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            },
            {
              "lessThan": "9cff220ddb65b022cc668bb652200742476e744c",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            },
            {
              "lessThan": "c4f626ddf2350652ad2f79daf1f10847f3f6eabd",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            },
            {
              "lessThan": "43f0005f81b8ce3be962d653cde8db9022f1e9b0",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            },
            {
              "lessThan": "9b51a6155d14389876916726430da30eabb1d4ed",
              "status": "affected",
              "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf,fork: wipe -\u003ebpf_storage before bailouts that access it\n\nCurrently, copy_process() can bail out to free_task() before p-\u003ebpf_storage\nhas been initialized, with this call graph (shown here for the\n!CONFIG_MEMCG case):\n\ncopy_process\n  dup_task_struct\n    arch_dup_task_struct\n      [copies the entire task_struct, including -\u003ebpf_storage member]\n  [RLIMIT_NPROC check fails]\n  delayed_free_task\n    free_task\n      bpf_task_storage_free\n        rcu_dereference(task-\u003ebpf_storage)\n        bpf_local_storage_destroy\n\nIn this case, the nascent task\u0027s -\u003ebpf_storage member that\nbpf_local_storage_destroy() operates on is a plain copy of the parent\u0027s\n-\u003ebpf_storage pointer, not a real initialized pointer.\nThis leads to badness (kernel hangs, UAF).\n\nThis is reachable as long as the process calling fork() has been inserted\ninto a task storage map."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via fork()/clone()/clone3() into copy_process() and free_task()-\u003ebpf_task_storage_free(); per kernel guidance BPF/fork paths are Local and no network-facing handler can drive this early-bailout teardown.\nAC:L - The attacker controls all conditions: dup_task_struct copies parent -\u003ebpf_storage, then they can deterministically force early copy_process failure (setrlimit(RLIMIT_NPROC) plus fork, fork-until-EAGAIN, or nr_threads exhaustion) to hit bpf_local_storage_destroy on the copied pointer.\nPR:L - Exploitation needs only a local process already inserted into a BPF task storage map (sched_ext/tracing BPF on servers, or BPF loaded via user-namespace CAP_BPF/unprivileged BPF); fork itself needs no real-root capability, so PR:L per user-namespace guidance.\nUI:N - No victim action is required; the attacker triggers the failed fork on a process they run and control the bailout timing themselves.\nS:U - Impact is in-kernel UAF/heap corruption and denial of service on the parent task\u0027s BPF local storage; this is standard kernel memory corruption without VM, container, or IOMMU boundary crossing.\nC:H - Destroying the parent\u0027s live bpf_local_storage via the child\u0027s stale -\u003ebpf_storage pointer is a use-after-free; freed bpf_local_storage/bpf_local_storage_elem objects can be reclaimed for arbitrary kernel memory disclosure per UAF guidance.\nI:H - bpf_local_storage_destroy() unlinks and frees parent storage still referenced by the live forking task, enabling heap grooming and attacker-controlled writes over freed BPF local storage structures for privilege escalation.\nA:H - The fix commit reports kernel hangs and UAF; tearing down active BPF task local storage during failed fork can oops, panic, or deadlock the system, satisfying High availability impact for kernel crashes/UAF."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:50.580Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7df67a4799067a59e6a2d53f8059a6be6e73e678"
        },
        {
          "url": "https://git.kernel.org/stable/c/aff686efd38728e06daf12417a0d7ed454ce4cff"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cff220ddb65b022cc668bb652200742476e744c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4f626ddf2350652ad2f79daf1f10847f3f6eabd"
        },
        {
          "url": "https://git.kernel.org/stable/c/43f0005f81b8ce3be962d653cde8db9022f1e9b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b51a6155d14389876916726430da30eabb1d4ed"
        }
      ],
      "title": "bpf,fork: wipe -\u003ebpf_storage before bailouts that access it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72110",
    "datePublished": "2026-08-15T05:52:51.805Z",
    "dateReserved": "2026-08-09T03:40:39.906Z",
    "dateUpdated": "2026-10-16T18:44:56.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72301",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:46:11.606714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:16.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bd715a9d882fe1993bb2aec5eff89fffa946592",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "0dce240145f47545d2e4b18c6d58033b83e1fd0e",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "ed4f758f34be4c32e02933ac4fa044589d9c1c16",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "0c4fbdaca225b97122b61b68c5353caa33a253c3",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "92f90917413bdd6078fefff6f6c83a07bf870b04",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            },
            {
              "lessThan": "1f97760417b5faa60e9642fd0ed61eb17d0b1b39",
              "status": "affected",
              "version": "544ac8858f249950b4d99c68e538cdc07300528f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get\n\nIn sof_ipc3_bytes_put(), the size used for the memcpy is derived from\nthe old data-\u003esize already in the buffer, not the incoming new data\u0027s\nsize field. If the new data has a different size, the copy length is\nwrong: it may truncate valid data or copy stale bytes.\n\nSimilarly, sof_ipc3_bytes_get() checks data-\u003esize against max_size\nwithout accounting for the sizeof(struct sof_ipc_ctrl_data) offset\nof the flex array within the allocation.\n\nFix bytes_put to validate and use the incoming data\u0027s sof_abi_hdr.size\nfrom ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata)\nfrom the bounds check to match the actual available space."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ALSA access via /dev/snd/controlC* and SNDRV_CTL_IOCTL_ELEM_READ/WRITE ioctls through snd_ctl_elem_write/read to sof_ipc3_bytes_put/get; SOF audio DSP controls are not reachable over the network.\nAC:L - An attacker can deterministically trigger the bug by sequencing bytes_put calls to set a large stale data-\u003esize then issue a second put with a smaller header, or use bytes_get after inflating size; no uncontrollable race or rare layout is required.\nPR:L - Only standard local access to the ALSA control device is needed; on typical Linux desktops and laptops with Intel/AMD SOF IPC3, session users in the audio group can write SOF bytes kcontrols without real root or init-namespace capabilities.\nUI:N - No victim interaction is required; a local attacker with sound-device access can directly issue ioctl-based ALSA control read/write operations against writable SOF bytes controls.\nS:U - The flaw corrupts kernel heap memory adjacent to a SOF control allocation and can enable local privilege escalation, but it does not cross a VM, IOMMU, or sandbox security boundary into another authority.\nC:H - sof_ipc3_bytes_get can memcpy up to roughly sizeof(struct sof_ipc_ctrl_data) bytes beyond the kzalloc(max_size) allocation into userspace when data-\u003esize passes an incorrect bound, leaking adjacent kernel heap contents.\nI:H - sof_ipc3_bytes_put uses stale data-\u003esize for memcpy length instead of the incoming sof_abi_hdr.size, enabling a heap out-of-bounds write past the control buffer that can corrupt adjacent kmalloc objects and be leveraged for code execution.\nA:H - The out-of-bounds read/write corrupts kernel heap metadata or adjacent objects and can cause kernel oops, panic, or hang when exploiting SOF IPC3 bytes controls on affected hardware."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:33.552Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bd715a9d882fe1993bb2aec5eff89fffa946592"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dce240145f47545d2e4b18c6d58033b83e1fd0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed4f758f34be4c32e02933ac4fa044589d9c1c16"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c4fbdaca225b97122b61b68c5353caa33a253c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/92f90917413bdd6078fefff6f6c83a07bf870b04"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f97760417b5faa60e9642fd0ed61eb17d0b1b39"
        }
      ],
      "title": "ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72301",
    "datePublished": "2026-08-15T05:55:20.430Z",
    "dateReserved": "2026-08-09T03:40:39.918Z",
    "dateUpdated": "2026-10-16T18:55:16.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:50:52.967716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:26.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "lessThan": "b422e3eff0edf0975de4883929adbed28f9d08bc",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "lessThan": "2fface6e0bbd6314d1d9d071abf2c4d67548511c",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "lessThan": "46762cefe7f4e5bffc1eb467810a7bbb02e461d7",
              "status": "affected",
              "version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "78b6803a1961369d0b8350ff1f99b7375bbd7a8f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5d73d9cdd6be22795499890ea928a6f57ef829c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6533fed1bfa842e391ee50f9a9c5e963c71e579",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2095ab2456da766174cda8bc105d7a7b1bc70e16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1fdb184aefa8447560e3ea0e605171592ffee41",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f75c8a3015422128ca150e81c730bc2a471b5f4a",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.71",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.111",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.48",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.54",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.22",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.71",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: serialize netif_running() check in enqueue_to_backlog()\n\nSyzbot reported a KASAN slab-use-after-free in fib_rules_lookup().\n\nThe root cause is a race condition where packets can escape the backlog\nflushing during device unregistration (e.g., during netns exit).\n\nCommit e9e4dd3267d0 (\"net: do not process device backlog during unregistration\")\nintroduced a lockless netif_running() check in enqueue_to_backlog() to\nprevent queuing packets to an unregistering device.\n\nHowever, this creates a TOCTOU race window.\n\nA lockless transmitter (like veth_xmit) can pass\nthe check before dev_close() clears IFF_UP. If the transmitter is then\ndelayed, flush_all_backlogs() can run and finish before the transmitter\ngrabs the backlog lock and queues the packet. The packet then escapes\nthe flush and triggers UAF later when processed.\n\nFix this by moving the netif_running() check inside the backlog lock.\nThis serializes the check with the flush work (which also grabs the lock).\nWe then either queue the packet before the flush runs (so it gets flushed),\nor check netif_running() after the flush/close completes (so it gets dropped)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the generic per-CPU backlog receive path (`netif_rx`/`netif_receive_skb` -\u003e `enqueue_to_backlog`); packets can originate from remote peers reaching veth/bridge/NIC interfaces, and syzbot reproduced it via network transmit/receive activity during device unregistration.\nAC:L - The attacker controls both racing sides by concurrently flooding packets through a lockless transmitter (e.g. veth) while unregistering the device/netns (e.g. `ip link del` or netns exit); no victim-specific timing or memory layout is required beyond repeatable parallel traffic and teardown.\nPR:L - Triggering veth creation, traffic injection, and netdev/netns teardown requires only `CAP_NET_ADMIN` inside a network namespace, obtainable by an unprivileged local user via user namespaces (`unshare -Urn`); init-namespace root is not required.\nUI:N - Exploitation needs only the attacker\u0027s own concurrent packet transmission and interface/netns teardown; no independent action by another user or administrator is required at trigger time.\nS:C - The use-after-free is triggered from within an isolated network namespace yet corrupts host-global kernel routing state (`fib_rules_lookup` on freed namespace/rule data), crossing the container/netns security boundary into the host kernel\u0027s integrity and availability.\nC:H - KASAN reported slab-use-after-free in `fib_rules_lookup()` walking `net-\u003erules_ops`; freed namespace/device-associated structures can be reallocated and read through stale pointers, yielding an attacker-influenceable kernel memory read/disclosure primitive.\nI:H - Processing the escaped backlog skb invokes routing through freed `fib_rules_ops` and indirect function pointers (`ops-\u003ematch`/`ops-\u003eaction`); UAF on these heap objects enables heap grooming, control-flow hijack, and arbitrary kernel write leading to privilege escalation.\nA:H - Confirmed slab-use-after-free in core packet processing during device unregistration reliably causes kernel oops/panic (syzbot KASAN splat in `fib_rules_lookup()`), and repeated triggering can deny service to the entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:45:02.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b422e3eff0edf0975de4883929adbed28f9d08bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fface6e0bbd6314d1d9d071abf2c4d67548511c"
        },
        {
          "url": "https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"
        }
      ],
      "title": "net: serialize netif_running() check in enqueue_to_backlog()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72493",
    "datePublished": "2026-08-15T05:57:27.642Z",
    "dateReserved": "2026-08-09T03:40:39.937Z",
    "dateUpdated": "2026-10-21T12:45:02.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:00:58.726885Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:57.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf09b0be8e851f050e98da702d247c14d81b591a",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "73dd3bf704ca6c20639de70c08e9a10bee904a95",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "f1a87ca0843d74482402a206ea2dfb315ee9acbd",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "60eafc7b08c6689ea3ad39eff8d97aefc8a087c7",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "d7860b682da55433b5da0591b0e4c1982ecd2689",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "b05defc41b27c7d0c05c45f67bf5b91c28f93669",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            },
            {
              "lessThan": "fcc77d33a34cf271702e8daafb6c593e4626776d",
              "status": "affected",
              "version": "e870456d8e7c8d57c059ea479b5aadbb55ff4c3a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/algif_skcipher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate\n\nThe AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-\u003eiv\ndirectly into the skcipher request. After io_submit() the socket lock is\ndropped and the request is processed asynchronously, so a concurrent\nsendmsg(ALG_SET_IV) can overwrite ctx-\u003eiv and make the in-flight request\nrun under an attacker-controlled IV. For CTR/stream modes this is\nIV/keystream reuse and lets an unprivileged user recover the plaintext of\na concurrent operation.\n\nSnapshotting ctx-\u003eiv into per-request storage for the async path is not\nsufficient. For ciphers with statesize == 0 - which includes cbc and ctr -\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place\nreq-\u003eiv writeback, which a snapshot redirects into per-request memory that\naf_alg_free_resources() releases on completion, silently producing wrong\noutput. Writing the IV back from the completion callback instead is not\npossible either: that would require lock_sock() there, but the callback can\nrun in softirq/atomic context, so it must not sleep.\n\nMake the operation synchronous instead, which removes both the IV race and\nany writeback race. This is equivalent to the upstream resolution, commit\nfcc77d33a34c (\"net: Remove support for AIO on sockets\"), which removed the\nAIO socket path across net/ entirely and so produces the same end state for\nthis file. This patch deviates from that commit deliberately: rather than\nremoving AIO socket support tree-wide, which would be far too invasive for\nstable, it removes only the AIO branch in crypto/algif_skcipher.c.\nio_submit() now completes synchronously; AF_ALG async is rarely used in\npractice.\n\nThe -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,\nand is left alone to keep the fix minimal.\n\nTested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls on an AF_ALG skcipher socket (socket/bind/accept/sendmsg plus async recvmsg, io_submit, aio_read, or io_uring read); the bug is not reachable from remote network protocols.\nAC:L - The attacker fully controls the race by running concurrent threads or syscalls on the same socket, timing async recvmsg/io_submit against sendmsg(ALG_SET_IV); pre-fix testing achieved thousands of successful IV injections in 200000 attempts.\nPR:L - Any unprivileged local user can create and use AF_ALG skcipher sockets without CAP_NET_ADMIN or init-namespace root; only standard UNIX discretionary access to the target socket FD is required, which includes same-UID multi-threaded processes.\nUI:N - Exploitation is fully attacker-driven through direct syscalls and requires no victim interaction such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to cryptographic operations on the compromised AF_ALG socket within the attacker\u0027s security context; it does not cross VM, container, or kernel-user authority boundaries like KVM escape or IOMMU bypass.\nC:H - Concurrent IV injection on CTR/stream ciphers causes keystream reuse, letting an attacker recover the full plaintext of an in-flight decrypt/encrypt on the same keyed socket even when the key never leaves kernel memory.\nI:H - Attacker-controlled IV injection corrupts in-flight cipher output and breaks MSG_MORE CBC/CTR chaining (statesize==0), silently producing attacker-influenced ciphertext/plaintext and undermining cryptographic integrity of concurrent operations.\nA:N - The flaw causes information disclosure and silent cryptographic corruption but does not kernel panic, oops, hang, or reliably deny service; availability impact is none beyond possible application-level misbehavior."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:57.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf09b0be8e851f050e98da702d247c14d81b591a"
        },
        {
          "url": "https://git.kernel.org/stable/c/73dd3bf704ca6c20639de70c08e9a10bee904a95"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1a87ca0843d74482402a206ea2dfb315ee9acbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b91e51d0eb7cbb07f7f086f9176bd93dbbc85dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/60eafc7b08c6689ea3ad39eff8d97aefc8a087c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7860b682da55433b5da0591b0e4c1982ecd2689"
        },
        {
          "url": "https://git.kernel.org/stable/c/b05defc41b27c7d0c05c45f67bf5b91c28f93669"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcc77d33a34cf271702e8daafb6c593e4626776d"
        }
      ],
      "title": "crypto: algif_skcipher - force synchronous processing on trees without ctx-\u003estate",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74578",
    "datePublished": "2026-08-16T08:20:32.055Z",
    "dateReserved": "2026-08-15T05:44:03.917Z",
    "dateUpdated": "2026-10-16T19:05:57.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74587",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:01:25.161847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:58.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c",
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10459b03e2d9ee12435e96f587de4d4cacdbf435",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "e1bb114e09372fd6e03387ced9ef566da336ed6c",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "179676f0166230c80053a392303485b37c93dd33",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "618b5c6d049896fcfabb91afc072954c92cb2693",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "07daf4f9750104960a1d60831b2353c0d41f35fb",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "d949992bc3f00027a2c755e860a11950c75f6073",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            },
            {
              "lessThan": "8c283e7b56adce00193837f3311b06662466fb21",
              "status": "affected",
              "version": "a000c01e60e40e15304ffe48fff051d17a7bea91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c",
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is triggered when the kernel processes inbound SCTP COOKIE-ECHO (peer restart) and ASCONF-ACK chunks from a remote association peer via sctp_rcv()/sctp_inq_push()/sctp_do_sm(), with no local syscall required on the victim.\nAC:L - The remote SCTP peer controls the full protocol sequence\u2014establishing an ADDIP-capable association, waiting for the victim\u0027s outstanding ASCONF, sending COOKIE-ECHO restart to purge queues, then delivering a delayed authenticated ASCONF-ACK\u2014without attacker-uncontrollable races or memory layout.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted COOKIE-ECHO and ASCONF-ACK packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - sctp_sf_do_asconf_ack() and sctp_process_asconf_ack() dereference the stale addip_last_asconf pointer to read freed sctp_chunk and skb metadata; UAF on slab-allocated chunk objects enables heap grooming for arbitrary kernel memory disclosure.\nI:H - The stale pointer causes sctp_process_asconf_ack() to perform a second sctp_chunk_free() on an already-freed chunk, yielding a kmem_cache double-free that can be leveraged for arbitrary kernel write or control-flow hijack.\nA:H - Dereferencing the freed cached ASCONF chunk during ASCONF-ACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:13.798Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693"
        },
        {
          "url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21"
        }
      ],
      "title": "sctp: fix use-after-free of cached ASCONF chunk",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74587",
    "datePublished": "2026-08-22T15:31:39.810Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-10-16T19:05:58.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:02:43.340591Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:06:02.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto.c",
            "net/netfilter/nf_conntrack_proto_sctp.c",
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca97360eba4b3dc67f1804625542f4ccc774242a",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "63853eb20bba4e00b7cd0b8cfc19337bbaaf5037",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "9480fcf70a5aa9d320088a01c95df0e5e6391f4a",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "0424186d570aa4d1ad17f516afb86bd9eaa4f42e",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "c0224327b7cbed9d3198e8dbec847281053dcd06",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "2d19b95c9723001f214f7a47d67b09f46238f200",
              "status": "affected",
              "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto.c",
            "net/netfilter/nf_conntrack_proto_sctp.c",
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct-\u003elock\nis still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is\nenabled, the log path can re-enter conntrack netlink glue and dump the\nsame conntrack again. Protocol attribute dumping may take ct-\u003elock, so\nlogging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while\nct-\u003elock is held and emitting the log after unlocking. Also make the TCP\ntimeout-lowering invalid path return whether a log is needed, then emit\nthat log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached\nwhile ct-\u003elock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers\nthat log invalid conntracks while holding ct-\u003elock are caught outside TCP\nand SCTP as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is hit in nf_conntrack_tcp_packet()/nf_conntrack_sctp_packet() from the NF_INET_PRE_ROUTING and LOCAL_OUT netfilter hooks on received or forwarded TCP/SCTP traffic, so a remote peer can trigger invalid conntrack handling with crafted packets to internet-facing NAT gateways, routers, and servers.\nAC:L - Once nf_conntrack_log_invalid, nflog binding, and NFULNL_CFG_F_CONNTRACK are enabled (the CVE-scoped configuration on monitored firewalls), an attacker deterministically deadlocks by sending invalid-sequence TCP or invalid-state SCTP packets on tracked flows without races or special memory layout.\nPR:N - Triggering the vulnerable conntrack path requires only the ability to send TCP/SCTP packets to a host already running connection tracking with invalid logging; no local account, CAP_NET_ADMIN, or netlink configuration privileges are needed on the attacker side.\nUI:N - Exploitation is driven entirely by network packet delivery and softirq packet processing; no victim must open files, mount filesystems, or perform any interactive action beyond normal network connectivity to the target.\nS:U - The deadlock confines impact to the same kernel networking authority processing the packet; it does not cross VM, container, or IOMMU boundaries to compromise a separate security domain.\nC:N - This is a recursive spinlock deadlock in conntrack invalid logging with no memory corruption, out-of-bounds access, use-after-free, or information-disclosure primitive.\nI:N - The bug causes a lock re-entry hang during logging only; it does not modify kernel or user data, provide arbitrary write primitives, or enable code execution.\nA:H - Re-acquiring ct-\u003elock while it is held deadlocks packet processing on the affected CPU in softirq context, can stall networking on that core, and may escalate to soft lockup or watchdog-induced kernel panic under sustained attack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:47.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca97360eba4b3dc67f1804625542f4ccc774242a"
        },
        {
          "url": "https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037"
        },
        {
          "url": "https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200"
        }
      ],
      "title": "netfilter: nf_conntrack: defer invalid log until after unlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74624",
    "datePublished": "2026-08-22T15:32:07.193Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-10-16T19:06:02.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80977",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:21:39.834701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:37.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6493165034bca14033bf49c9cec7b45e97a91497",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "b4452349dcf4d561e13be768d5d278de58248930",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "363c4252ffc473a0203e91b83ede5519dfb8bd07",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "6ec22afc82a3cae07ade0a6ec361ae2532128ff5",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "15aa81b390d401abf4b8211042470e9e92e3b7fb",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "288f9970670841044ab030104fa6b6ed159949d0",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "0370da114a9bc044e248b85c6809d1b5e0c1f7f9",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            },
            {
              "lessThan": "f66bdb1cc0fcd227a062378f8be0b5873aa5600a",
              "status": "affected",
              "version": "25121173f7b1e4ac3fc692df6e7b8c52ec36abba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone\nshares, while the caller only owns the reference it is about to drop.\nThrough a clone it tells the producer its pages are free and drops\nSKBFL_SHARED_FRAG for an skb that is still in flight.\n\nOpen vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone()\ndoes not privatise the frags here -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker\nfrom the packet still being forwarded, and a later local ESP delivery\ndecrypts in place over frags it does not own privately.\n\nSkip it for a cloned skb. Nothing is lost: skb_release_data() clears\nthe zerocopy state once the last reference to the shared data goes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The buggy state is a locally originated MSG_ZEROCOPY/io_uring TX skb (SKBFL_DONT_ORPHAN plus a uarg); NIC-received packets never carry that marker, and the skb must still be forwarded into local ESP, so a local account is required.\nAC:L - The attacker fully controls both sides: OVS flows with a non-last RECIRC, a guaranteed miss/upcall failure on the clone, MSG_ZEROCOPY send, and the ESP SA/payload, so the shared-shinfo strip and in-place decrypt are reliably reproducible with no race beyond attacker influence.\nPR:L - An unprivileged user can enable SO_ZEROCOPY and, via unshare -Urn, obtain CAP_NET_ADMIN in a user+net namespace; OVS genetlink uses GENL_UNS_ADMIN_PERM and XFRM SAs are likewise namespace-installable, while the global page cache remains the corruption target.\nUI:N - The attacker installs the OVS recirc flow, sends the MSG_ZEROCOPY packet, and completes local ESP delivery without any victim action.\nS:U - The resulting page-cache write and premature zerocopy completion stay inside the host kernel\u0027s memory authority as a standard local memory-corruption/LPE primitive and do not cross a VM or IOMMU boundary.\nC:H - skb_tx_error() on the clone completes the shared uarg and clears SKBFL_SHARED_FRAG, so later in-place ESP decrypt (and UAF of still-mapped pages) corrupts globally cached file/code pages and can be leveraged for arbitrary disclosure.\nI:H - With the shared-frag marker stripped, esp_input() skips skb_cow_data() and AEAD-decrypts attacker-controlled plaintext in place over page-cache-backed frags, yielding an unprivileged write into files the sender could only read (the Fragnesia primitive).\nA:H - Use-after-free of zerocopy pages still referenced by the in-flight original skb, plus overwriting page-cache-backed executable or kernel-managed data, causes oopses, panics, and process crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:46:01.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6493165034bca14033bf49c9cec7b45e97a91497"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4452349dcf4d561e13be768d5d278de58248930"
        },
        {
          "url": "https://git.kernel.org/stable/c/363c4252ffc473a0203e91b83ede5519dfb8bd07"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ec22afc82a3cae07ade0a6ec361ae2532128ff5"
        },
        {
          "url": "https://git.kernel.org/stable/c/15aa81b390d401abf4b8211042470e9e92e3b7fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/288f9970670841044ab030104fa6b6ed159949d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/0370da114a9bc044e248b85c6809d1b5e0c1f7f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f66bdb1cc0fcd227a062378f8be0b5873aa5600a"
        }
      ],
      "title": "net: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80977",
    "datePublished": "2026-09-11T19:42:38.862Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-10-19T08:46:01.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89528",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:02.453234Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:41.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08aa4162df91880a79be744aaa9570b04d4875c4",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "beb4e9801f6362436102acc4cc5304b7324f9365",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "e70fdb121171c3eb0ac34eb545721828cd737717",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "1a3af2262cb384112ef38632de4690682be528b4",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "465f511f59a0fa7a80d5d1073c4b24f28ea38f58",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            },
            {
              "lessThan": "0ca487abb3bdf581851664b5db21f364caf57682",
              "status": "affected",
              "version": "026d958b38c628a1b4ced534808945365e2747a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Read lists that exceed the page budget\n\nIndividual Read segment lengths are validated at decode time, but\nnothing prevents a requester from sending multiple segments whose\ncumulative length exceeds the rq_pages array budget. When one\nsegment fills the page array exactly, the runtime guard in\nsvc_rdma_build_read_segment() is bypassed because len reaches zero.\nA subsequent segment then accesses the NULL sentinel slot at\nrq_pages[rq_maxpages], resulting in a NULL pointer dereference during\nDMA mapping.\n\nAccumulate pages across all Read segments and reject the message at\ndecode time when the total would overflow the page budget."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote peer reaches svc_rdma_recvfrom() by sending a Call with a Read list on an enabled NFS/RDMA listener over routable RoCEv2 or iWARP.\nAC:L - The attacker fully controls Read-segment lengths in the transport header and can deterministically fill rq_pages exactly, then send a further segment so the len==0 overrun guard is skipped and the NULL sentinel is DMA-mapped, with no race or uncontrollable layout.\nPR:N - xdr_count_read_segments() and svc_rdma_build_read_segment() run in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.\nUI:N - Sending a crafted RPC-over-RDMA message with an over-budget Read list is sufficient; no victim mount, click, or other user action is required.\nS:U - The NULL dereference oops stays in the host kernel that owns nfsd/svcrdma; this is not a VM, IOMMU, or sandbox escape.\nC:N - The fault is a NULL pointer dereference of the rq_pages[rq_maxpages] sentinel during DMA mapping; the access faults immediately and does not disclose kernel memory.\nI:N - The sentinel slot is a guaranteed NULL page pointer, not an out-of-bounds page used as a write destination; DMA mapping aborts on the NULL page without an arbitrary-write or control-flow hijack primitive.\nA:H - DMA mapping the NULL sentinel produces a kernel oops or panic that an unauthenticated NFS/RDMA peer can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:32:00.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08aa4162df91880a79be744aaa9570b04d4875c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/beb4e9801f6362436102acc4cc5304b7324f9365"
        },
        {
          "url": "https://git.kernel.org/stable/c/e70fdb121171c3eb0ac34eb545721828cd737717"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682"
        }
      ],
      "title": "svcrdma: Reject Read lists that exceed the page budget",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89528",
    "datePublished": "2026-09-11T19:44:08.514Z",
    "dateReserved": "2026-09-11T19:38:34.719Z",
    "dateUpdated": "2026-10-30T12:32:00.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89542",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:31.016705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:42.330Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_krb5_wrap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "299d281c7225ded15b28cb861a98d818d82787fc",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "84ddbc8d084c0251d534f14f5d1a7da05be56404",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "075d7cfc4df8c54cb202ba8b28420370c03ba9b6",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "f2591660e0eb263c9415bf0d0bb1b111e62df7a4",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "806584a4b67a7233870c33e5b8f872e76dd02988",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "a7894e10572d53eb10109b8d07459cc8d3435811",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "6959297aaa9572783d620a226d73c3fb94494888",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_krb5_wrap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\n\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\n(16) bytes long, and its rotate_left() helper passes buf-\u003elen - base\nto xdr_buf_subsegment() without verifying that base \u003c= buf-\u003elen. When\na caller hands in a sub-16-byte token, or a token whose declared len\nleaves base past the end of the buffer, three distinct failures follow:\n\n    gss_krb5_unwrap_v2(offset, len, buf)\n      ptr = buf-\u003ehead[0].iov_base + offset\n      ec  = *(ptr + 4)              /* OOB read on short head */\n      rrc = *(ptr + 6)              /* OOB read on short head */\n      rotate_left(offset + 16, buf, rrc)\n        xdr_buf_subsegment(buf, \u0026subbuf,\n                           base, buf-\u003elen - base)   /* u32 wrap when base \u003e len */\n        _rotate_left(\u0026subbuf, shift)\n          shift %= buf-\u003elen         /* divide-by-zero when base == len */\n\nAfter decryption, the cleanup arithmetic has the same shape:\n\n    movelen = min_t(unsigned int, buf-\u003ehead[0].iov_len, len);\n    movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\n    BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen \u003e\n                                            buf-\u003ehead[0].iov_len);\n\nThe BUG_ON re-adds the value just subtracted, so it reduces to\nmin(A, B) \u003e A and is permanently false; it cannot catch the unsigned\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\n\nAdd four defense-in-depth guards inside the unwrap core so it is safe\nregardless of what its callers validate:\n\n  - reject tokens with len - offset \u003c GSS_KRB5_TOK_HDR_LEN before\n    touching ptr+4/ptr+6;\n  - bail from rotate_left() when buf-\u003elen \u003c= base, covering both the\n    underflow and zero-length cases;\n  - return early from _rotate_left() when buf-\u003elen is zero, so the\n    shift %= buf-\u003elen modulo cannot fault;\n  - replace the dead BUG_ON with a live check that returns\n    GSS_S_DEFECTIVE_TOKEN before the movelen subtraction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - gss_krb5_unwrap_v2() is reached from nfsd RPCSEC_GSS privacy unwrap (svcauth_gss_accept \u2192 svcauth_gss_unwrap_priv \u2192 gss_unwrap) on TCP/2049 and from the NFS client gss_unwrap_resp_priv() path on a krb5p Reply, so a remote RPCSEC_GSS peer delivers the crafted wrap token over the network.\nAC:L - A single crafted RPCSEC_GSS DATA/Reply with a sub-16-byte wrap token (KG2_TOK_WRAP, sealed flags, non-zero RRC) deterministically hits the pre-decrypt ptr+4/ptr+6 reads, rotate_left() u32 wrap, and shift%=0 divide-by-zero; no race or attacker-uncontrollable layout is required.\nPR:N - A malicious NFS server on an existing krb5p session needs no account or capability on the victim client to send the crafted Reply into gss_unwrap_resp_priv(). That client-victim path is the highest-severity reachability and requires no privileges on the target.\nUI:N - nfsd unwraps the Call in the service thread with no local user action. On the client, gss_unwrap_resp_priv() runs automatically from the RPC receive path once an NFS/RPCSEC_GSS mount exists; no additional mount, click, or open is required at attack time.\nS:U - The out-of-bounds accesses, divide-by-zero, and underflowed memmove corrupt host kernel SUNRPC/GSS state on the machine processing the RPC. This is ordinary same-host kernel impact, not a VM escape, IOMMU bypass, or other changed-scope boundary.\nC:H - Short tokens make gss_krb5_unwrap_v2() read EC/RRC past the token, and the dead BUG_ON lets unsigned movelen underflow into a ~UINT_MAX-byte memmove() that copies kernel memory beyond the receive head; that unbounded read is C:H per kernel CNA memory-corruption guidance.\nI:H - The same underflowed memmove() writes near 4GiB through the RPC receive head, an out-of-bounds write exploitable for control-flow hijack. rotate_left() also ignores xdr_buf_subsegment() failure after u32 wrap and then writes through a subbuf whose length has wrapped.\nA:H - _rotate_left() does shift %= buf-\u003elen on a zero-length subbuffer (header-only token at the XDR boundary), a divide-by-zero oops/panic; the UINT_MAX memmove and wrapped-length rotate loop hang or oops nfsd/rpciod, and the attacker can repeat the RPC to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:33.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404"
        },
        {
          "url": "https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087"
        },
        {
          "url": "https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811"
        },
        {
          "url": "https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888"
        }
      ],
      "title": "SUNRPC: harden gss_krb5_unwrap_v2 against short tokens",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89542",
    "datePublished": "2026-09-11T19:44:18.931Z",
    "dateReserved": "2026-09-11T19:38:34.722Z",
    "dateUpdated": "2026-10-19T08:48:33.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}