Action not permitted
Modal body text goes here.
Modal Title
Modal Body
WID-SEC-W-2026-0861
Vulnerability from csaf_certbund - Published: 2026-03-24 23:00 - Updated: 2026-03-25 23:00Summary
Linux Kernel: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen, weitere nicht spezifizierte Auswirkungen zu verursachen und potentiell Code auszuführen.
Betroffene Betriebssysteme: - Linux
References
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsma\u00dfnahmen zu umgehen, Informationen offenzulegen, weitere nicht spezifizierte Auswirkungen zu verursachen und potentiell Code auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-0861 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0861.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-0861 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0861"
},
{
"category": "external",
"summary": "Kernel CVE Announce Mailingliste",
"url": "https://lore.kernel.org/linux-cve-announce/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23279",
"url": "https://lore.kernel.org/linux-cve-announce/2026032522-CVE-2026-23279-cf34@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23280",
"url": "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23280-cd9e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23281",
"url": "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23281-2e62@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23282",
"url": "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23282-bad0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23283",
"url": "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23283-3d92@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23284",
"url": "https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23284-ca53@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23285",
"url": "https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23285-ad41@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23286",
"url": "https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23286-8a7e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23287",
"url": "https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23287-93b2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23288",
"url": "https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23288-1d11@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23289",
"url": "https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23289-aa54@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23290",
"url": "https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23290-af97@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23291",
"url": "https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23291-eae3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23292",
"url": "https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23292-67e8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23293",
"url": "https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23293-b422@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23294",
"url": "https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23294-1682@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23295",
"url": "https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23295-59d2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23296",
"url": "https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23296-eb4a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23297",
"url": "https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23297-bcad@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23298",
"url": "https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23298-fad9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23299",
"url": "https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23299-6471@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23300",
"url": "https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23300-9bc4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23301",
"url": "https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23301-09e7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23302",
"url": "https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23302-e03d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23303",
"url": "https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23303-8e38@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23304",
"url": "https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23304-485b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23305",
"url": "https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23305-5fa4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23306",
"url": "https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23306-8854@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23307",
"url": "https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23307-60f2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23308",
"url": "https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23308-1e72@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23309",
"url": "https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23309-4243@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23310",
"url": "https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23310-9b67@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23311",
"url": "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23311-8c0b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23312",
"url": "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23312-2b11@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23313",
"url": "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23313-925e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23314",
"url": "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23314-166c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23315",
"url": "https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23315-9ac1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23316",
"url": "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23316-2ce3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23317",
"url": "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23317-0e9e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23318",
"url": "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23318-bef0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23319",
"url": "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23319-1e3d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23320",
"url": "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23320-0ae7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23321",
"url": "https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23321-6059@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23322",
"url": "https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23322-9fd3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23323",
"url": "https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23323-53db@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23324",
"url": "https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23324-bc9e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23325",
"url": "https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23325-4e3b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23326",
"url": "https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23326-ffc6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23327",
"url": "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23327-c497@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23328",
"url": "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23328-9600@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23329",
"url": "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23329-c743@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23330",
"url": "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23330-00fd@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23331",
"url": "https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23331-735b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23332",
"url": "https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23332-50e0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23333",
"url": "https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23333-417f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23334",
"url": "https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23334-1b12@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23335",
"url": "https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23335-602d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23336",
"url": "https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23336-d365@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23337",
"url": "https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23337-5018@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23338",
"url": "https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23338-67c7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23339",
"url": "https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23339-263f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23340",
"url": "https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23340-1aa9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23341",
"url": "https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23341-3f7b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23342",
"url": "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23342-8456@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23343",
"url": "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23343-dc2b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23344",
"url": "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23344-0279@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23345",
"url": "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23345-c154@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23346",
"url": "https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23346-faed@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23347",
"url": "https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23347-fa08@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23348",
"url": "https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23348-e792@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23349",
"url": "https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23349-aa6a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23350",
"url": "https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23350-f4be@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23351",
"url": "https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23351-637f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23352",
"url": "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23352-18f2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23353",
"url": "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23353-d0c3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23354",
"url": "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23354-d9b2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23355",
"url": "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23355-86df@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23356",
"url": "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23356-0014@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23357",
"url": "https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23357-605e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23358",
"url": "https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23358-1042@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23359",
"url": "https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23359-35fd@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23360",
"url": "https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23360-c464@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23361",
"url": "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23361-bd5c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23362",
"url": "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23362-40bd@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23363",
"url": "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23363-3e24@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23364",
"url": "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23364-4267@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23365",
"url": "https://lore.kernel.org/linux-cve-announce/2026032539-CVE-2026-23365-76d3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23366",
"url": "https://lore.kernel.org/linux-cve-announce/2026032540-CVE-2026-23366-a7c4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23367",
"url": "https://lore.kernel.org/linux-cve-announce/2026032540-CVE-2026-23367-6e44@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23368",
"url": "https://lore.kernel.org/linux-cve-announce/2026032540-CVE-2026-23368-c240@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23369",
"url": "https://lore.kernel.org/linux-cve-announce/2026032540-CVE-2026-23369-b6c6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23370",
"url": "https://lore.kernel.org/linux-cve-announce/2026032540-CVE-2026-23370-02d2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23371",
"url": "https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23371-1b32@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23372",
"url": "https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23372-7bc9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23373",
"url": "https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23373-0203@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23374",
"url": "https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23374-9345@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23375",
"url": "https://lore.kernel.org/linux-cve-announce/2026032541-CVE-2026-23375-91b1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23376",
"url": "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23376-114a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23377",
"url": "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23377-cb04@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23378",
"url": "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23378-f329@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23379",
"url": "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23379-3b2d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23380",
"url": "https://lore.kernel.org/linux-cve-announce/2026032542-CVE-2026-23380-9e3c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23381",
"url": "https://lore.kernel.org/linux-cve-announce/2026032543-CVE-2026-23381-378d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23382",
"url": "https://lore.kernel.org/linux-cve-announce/2026032543-CVE-2026-23382-26fe@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23383",
"url": "https://lore.kernel.org/linux-cve-announce/2026032543-CVE-2026-23383-f205@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23384",
"url": "https://lore.kernel.org/linux-cve-announce/2026032543-CVE-2026-23384-489a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23385",
"url": "https://lore.kernel.org/linux-cve-announce/2026032543-CVE-2026-23385-3414@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23386",
"url": "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23386-acc4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23387",
"url": "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23387-4399@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23388",
"url": "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23388-9e71@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23389",
"url": "https://lore.kernel.org/linux-cve-announce/2026032544-CVE-2026-23389-2056@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23390",
"url": "https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23390-7146@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23391",
"url": "https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23391-bb43@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23392",
"url": "https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23392-fd9d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23393",
"url": "https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23393-c395@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23394",
"url": "https://lore.kernel.org/linux-cve-announce/2026032549-CVE-2026-23394-9205@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2026-23395",
"url": "https://lore.kernel.org/linux-cve-announce/2026032549-CVE-2026-23395-5e50@gregkh/"
}
],
"source_lang": "en-US",
"title": "Linux Kernel: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-03-25T23:00:00.000+00:00",
"generator": {
"date": "2026-03-26T07:56:13.854+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2026-0861",
"initial_release_date": "2026-03-24T23:00:00.000+00:00",
"revision_history": [
{
"date": "2026-03-24T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-03-25T23:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2026-15382, EUVD-2026-15378, EUVD-2026-15381, EUVD-2026-15376, EUVD-2026-15374, EUVD-2026-15372, EUVD-2026-15371, EUVD-2026-15367, EUVD-2026-15368, EUVD-2026-15363, EUVD-2026-15365, EUVD-2026-15362, EUVD-2026-15359, EUVD-2026-15357, EUVD-2026-15355, EUVD-2026-15353, EUVD-2026-15351, EUVD-2026-15350, EUVD-2026-15345, EUVD-2026-15343, EUVD-2026-15344, EUVD-2026-15342, EUVD-2026-15336, EUVD-2026-15340, EUVD-2026-15339, EUVD-2026-15334, EUVD-2026-15332, EUVD-2026-15330, EUVD-2026-15328, EUVD-2026-15325, EUVD-2026-15329, EUVD-2026-15321, EUVD-2026-15323, EUVD-2026-15319, EUVD-2026-15317, EUVD-2026-15313, EUVD-2026-15312, EUVD-2026-15311, EUVD-2026-15310, EUVD-2026-15309, EUVD-2026-15308, EUVD-2026-15305, EUVD-2026-15307, EUVD-2026-15304, EUVD-2026-15299, EUVD-2026-15298, EUVD-2026-15295, EUVD-2026-15293, EUVD-2026-15292, EUVD-2026-15289, EUVD-2026-15287, EUVD-2026-15285, EUVD-2026-15284, EUVD-2026-15279, EUVD-2026-15278, EUVD-2026-15277, EUVD-2026-15276, EUVD-2026-15272, EUVD-2026-15274, EUVD-2026-15271, EUVD-2026-15269, EUVD-2026-15267, EUVD-2026-15263, EUVD-2026-15261, EUVD-2026-15258, EUVD-2026-15256, EUVD-2026-15254, EUVD-2026-15253, EUVD-2026-15252, EUVD-2026-15251, EUVD-2026-15250, EUVD-2026-15245, EUVD-2026-15248, EUVD-2026-15242, EUVD-2026-15238, EUVD-2026-15240, EUVD-2026-15235, EUVD-2026-15236, EUVD-2026-15234, EUVD-2026-15231, EUVD-2026-15233, EUVD-2026-15227, EUVD-2026-15224, EUVD-2026-15225, EUVD-2026-15221, EUVD-2026-15220, EUVD-2026-15218, EUVD-2026-15219, EUVD-2026-15216, EUVD-2026-15215, EUVD-2026-15211, EUVD-2026-15206, EUVD-2026-15208, EUVD-2026-15204, EUVD-2026-15200, EUVD-2026-15203, EUVD-2026-15198, EUVD-2026-15366, EUVD-2026-15384, EUVD-2026-15387, EUVD-2026-15388, EUVD-2026-15390, EUVD-2026-15392, EUVD-2026-15393, EUVD-2026-15394, EUVD-2026-15396, EUVD-2026-15398, EUVD-2026-15281, EUVD-2026-15348, EUVD-2026-15391, EUVD-2026-15331, EUVD-2026-15315, EUVD-2026-15301, EUVD-2026-15264, EUVD-2026-15246, EUVD-2026-15230, EUVD-2026-15212"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Open Source Linux Kernel",
"product": {
"name": "Open Source Linux Kernel",
"product_id": "T028462",
"product_identification_helper": {
"cpe": "cpe:/o:linux:linux_kernel:unspecified"
}
}
}
],
"category": "vendor",
"name": "Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-23279",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23279"
},
{
"cve": "CVE-2026-23280",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23280"
},
{
"cve": "CVE-2026-23281",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23281"
},
{
"cve": "CVE-2026-23282",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23282"
},
{
"cve": "CVE-2026-23283",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23283"
},
{
"cve": "CVE-2026-23284",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23284"
},
{
"cve": "CVE-2026-23285",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23285"
},
{
"cve": "CVE-2026-23286",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23286"
},
{
"cve": "CVE-2026-23287",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23287"
},
{
"cve": "CVE-2026-23288",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23288"
},
{
"cve": "CVE-2026-23289",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23289"
},
{
"cve": "CVE-2026-23290",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23290"
},
{
"cve": "CVE-2026-23291",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23291"
},
{
"cve": "CVE-2026-23292",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23292"
},
{
"cve": "CVE-2026-23293",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23293"
},
{
"cve": "CVE-2026-23294",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23294"
},
{
"cve": "CVE-2026-23295",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23295"
},
{
"cve": "CVE-2026-23296",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23296"
},
{
"cve": "CVE-2026-23297",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23297"
},
{
"cve": "CVE-2026-23298",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23298"
},
{
"cve": "CVE-2026-23299",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23299"
},
{
"cve": "CVE-2026-23300",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23300"
},
{
"cve": "CVE-2026-23301",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23301"
},
{
"cve": "CVE-2026-23302",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23302"
},
{
"cve": "CVE-2026-23303",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23303"
},
{
"cve": "CVE-2026-23304",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23304"
},
{
"cve": "CVE-2026-23305",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23305"
},
{
"cve": "CVE-2026-23306",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23306"
},
{
"cve": "CVE-2026-23307",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23307"
},
{
"cve": "CVE-2026-23308",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23308"
},
{
"cve": "CVE-2026-23309",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23309"
},
{
"cve": "CVE-2026-23310",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23310"
},
{
"cve": "CVE-2026-23311",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23311"
},
{
"cve": "CVE-2026-23312",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23312"
},
{
"cve": "CVE-2026-23313",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23313"
},
{
"cve": "CVE-2026-23314",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23314"
},
{
"cve": "CVE-2026-23315",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23315"
},
{
"cve": "CVE-2026-23316",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23316"
},
{
"cve": "CVE-2026-23317",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23317"
},
{
"cve": "CVE-2026-23318",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23318"
},
{
"cve": "CVE-2026-23319",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23319"
},
{
"cve": "CVE-2026-23320",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23320"
},
{
"cve": "CVE-2026-23321",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23321"
},
{
"cve": "CVE-2026-23322",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23322"
},
{
"cve": "CVE-2026-23323",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23323"
},
{
"cve": "CVE-2026-23324",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23324"
},
{
"cve": "CVE-2026-23325",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23325"
},
{
"cve": "CVE-2026-23326",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23326"
},
{
"cve": "CVE-2026-23327",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23327"
},
{
"cve": "CVE-2026-23328",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23328"
},
{
"cve": "CVE-2026-23329",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23329"
},
{
"cve": "CVE-2026-23330",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23330"
},
{
"cve": "CVE-2026-23331",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23331"
},
{
"cve": "CVE-2026-23332",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23332"
},
{
"cve": "CVE-2026-23333",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23333"
},
{
"cve": "CVE-2026-23334",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23334"
},
{
"cve": "CVE-2026-23335",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23335"
},
{
"cve": "CVE-2026-23336",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23336"
},
{
"cve": "CVE-2026-23337",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23337"
},
{
"cve": "CVE-2026-23338",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23338"
},
{
"cve": "CVE-2026-23339",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23339"
},
{
"cve": "CVE-2026-23340",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23340"
},
{
"cve": "CVE-2026-23341",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23341"
},
{
"cve": "CVE-2026-23342",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23342"
},
{
"cve": "CVE-2026-23343",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23343"
},
{
"cve": "CVE-2026-23344",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23344"
},
{
"cve": "CVE-2026-23345",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23345"
},
{
"cve": "CVE-2026-23346",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23346"
},
{
"cve": "CVE-2026-23347",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23347"
},
{
"cve": "CVE-2026-23348",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23348"
},
{
"cve": "CVE-2026-23349",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23349"
},
{
"cve": "CVE-2026-23350",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23350"
},
{
"cve": "CVE-2026-23351",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23351"
},
{
"cve": "CVE-2026-23352",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23352"
},
{
"cve": "CVE-2026-23353",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23353"
},
{
"cve": "CVE-2026-23354",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23354"
},
{
"cve": "CVE-2026-23355",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23355"
},
{
"cve": "CVE-2026-23356",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23356"
},
{
"cve": "CVE-2026-23357",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23357"
},
{
"cve": "CVE-2026-23358",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23358"
},
{
"cve": "CVE-2026-23359",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23359"
},
{
"cve": "CVE-2026-23360",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23360"
},
{
"cve": "CVE-2026-23361",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23361"
},
{
"cve": "CVE-2026-23362",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23362"
},
{
"cve": "CVE-2026-23363",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23363"
},
{
"cve": "CVE-2026-23364",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23364"
},
{
"cve": "CVE-2026-23365",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23365"
},
{
"cve": "CVE-2026-23366",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23366"
},
{
"cve": "CVE-2026-23367",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23367"
},
{
"cve": "CVE-2026-23368",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23368"
},
{
"cve": "CVE-2026-23369",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23369"
},
{
"cve": "CVE-2026-23370",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23370"
},
{
"cve": "CVE-2026-23371",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23371"
},
{
"cve": "CVE-2026-23372",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23372"
},
{
"cve": "CVE-2026-23373",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23373"
},
{
"cve": "CVE-2026-23374",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23374"
},
{
"cve": "CVE-2026-23375",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23375"
},
{
"cve": "CVE-2026-23376",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23376"
},
{
"cve": "CVE-2026-23377",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23377"
},
{
"cve": "CVE-2026-23378",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23378"
},
{
"cve": "CVE-2026-23379",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23379"
},
{
"cve": "CVE-2026-23380",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23380"
},
{
"cve": "CVE-2026-23381",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23381"
},
{
"cve": "CVE-2026-23382",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23382"
},
{
"cve": "CVE-2026-23383",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23383"
},
{
"cve": "CVE-2026-23384",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23384"
},
{
"cve": "CVE-2026-23385",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23385"
},
{
"cve": "CVE-2026-23386",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23386"
},
{
"cve": "CVE-2026-23387",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23387"
},
{
"cve": "CVE-2026-23388",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23388"
},
{
"cve": "CVE-2026-23389",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23389"
},
{
"cve": "CVE-2026-23390",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23390"
},
{
"cve": "CVE-2026-23391",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23391"
},
{
"cve": "CVE-2026-23392",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23392"
},
{
"cve": "CVE-2026-23393",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23393"
},
{
"cve": "CVE-2026-23394",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23394"
},
{
"cve": "CVE-2026-23395",
"product_status": {
"known_affected": [
"T028462"
]
},
"release_date": "2026-03-24T23:00:00.000+00:00",
"title": "CVE-2026-23395"
}
]
}
CVE-2026-23309 (GCVE-0-2026-23309)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
tracing: Add NULL pointer check to trigger_data_free()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()
jumps to the out_free error path. While kfree() safely handles a NULL
pointer, trigger_data_free() does not. This causes a NULL pointer
dereference in trigger_data_free() when evaluating
data->cmd_ops->set_filter.
Fix the problem by adding a NULL pointer check to trigger_data_free().
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
c10f0efe57728508d796ae4ba7abe4c14ec3d8ef , < 13dcd9269e225e4c4ceabdaeebe2ce4661b54c6e
(git)
Affected: 7e6556e9329bc484e9dcdab6e346d959267c0636 , < 59c15b9cc453b74beb9f04c6c398717e73612dc3 (git) Affected: 9b0513905e0598b9f8cfccab8e47497aed5d935d , < 42b380f97d65e76e7b310facd525f730272daf57 (git) Affected: 335dfe4bc6368e70e8c15419375cf609c4f85558 , < 2ce8ece5a78da67834db7728edc801889a64f643 (git) Affected: e42efbe9754da78eafe11f6bd3ca9c8a094a752a , < 477469223b2b840f436ce204333de87cb17e5d93 (git) Affected: 0550069cc25f513ce1f109c88f7c1f01d63297db , < 457965c13f0837a289c9164b842d0860133f6274 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_trigger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13dcd9269e225e4c4ceabdaeebe2ce4661b54c6e",
"status": "affected",
"version": "c10f0efe57728508d796ae4ba7abe4c14ec3d8ef",
"versionType": "git"
},
{
"lessThan": "59c15b9cc453b74beb9f04c6c398717e73612dc3",
"status": "affected",
"version": "7e6556e9329bc484e9dcdab6e346d959267c0636",
"versionType": "git"
},
{
"lessThan": "42b380f97d65e76e7b310facd525f730272daf57",
"status": "affected",
"version": "9b0513905e0598b9f8cfccab8e47497aed5d935d",
"versionType": "git"
},
{
"lessThan": "2ce8ece5a78da67834db7728edc801889a64f643",
"status": "affected",
"version": "335dfe4bc6368e70e8c15419375cf609c4f85558",
"versionType": "git"
},
{
"lessThan": "477469223b2b840f436ce204333de87cb17e5d93",
"status": "affected",
"version": "e42efbe9754da78eafe11f6bd3ca9c8a094a752a",
"versionType": "git"
},
{
"lessThan": "457965c13f0837a289c9164b842d0860133f6274",
"status": "affected",
"version": "0550069cc25f513ce1f109c88f7c1f01d63297db",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_trigger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0-rc1"
},
{
"lessThan": "7.0-rc1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "7.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add NULL pointer check to trigger_data_free()\n\nIf trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()\njumps to the out_free error path. While kfree() safely handles a NULL\npointer, trigger_data_free() does not. This causes a NULL pointer\ndereference in trigger_data_free() when evaluating\ndata-\u003ecmd_ops-\u003eset_filter.\n\nFix the problem by adding a NULL pointer check to trigger_data_free().\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:04.828Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13dcd9269e225e4c4ceabdaeebe2ce4661b54c6e"
},
{
"url": "https://git.kernel.org/stable/c/59c15b9cc453b74beb9f04c6c398717e73612dc3"
},
{
"url": "https://git.kernel.org/stable/c/42b380f97d65e76e7b310facd525f730272daf57"
},
{
"url": "https://git.kernel.org/stable/c/2ce8ece5a78da67834db7728edc801889a64f643"
},
{
"url": "https://git.kernel.org/stable/c/477469223b2b840f436ce204333de87cb17e5d93"
},
{
"url": "https://git.kernel.org/stable/c/457965c13f0837a289c9164b842d0860133f6274"
}
],
"title": "tracing: Add NULL pointer check to trigger_data_free()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23309",
"datePublished": "2026-03-25T10:27:04.828Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:04.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23292 (GCVE-0-2026-23292)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 16:49
VLAI?
EPSS
Title
scsi: target: Fix recursive locking in __configfs_open_file()
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Fix recursive locking in __configfs_open_file()
In flush_write_buffer, &p->frag_sem is acquired and then the loaded store
function is called, which, here, is target_core_item_dbroot_store(). This
function called filp_open(), following which these functions were called
(in reverse order), according to the call trace:
down_read
__configfs_open_file
do_dentry_open
vfs_open
do_open
path_openat
do_filp_open
file_open_name
filp_open
target_core_item_dbroot_store
flush_write_buffer
configfs_write_iter
target_core_item_dbroot_store() tries to validate the new file path by
trying to open the file path provided to it; however, in this case, the bug
report shows:
db_root: not a directory: /sys/kernel/config/target/dbroot
indicating that the same configfs file was tried to be opened, on which it
is currently working on. Thus, it is trying to acquire frag_sem semaphore
of the same file of which it already holds the semaphore obtained in
flush_write_buffer(), leading to acquiring the semaphore in a nested manner
and a possibility of recursive locking.
Fix this by modifying target_core_item_dbroot_store() to use kern_path()
instead of filp_open() to avoid opening the file using filesystem-specific
function __configfs_open_file(), and further modifying it to make this fix
compatible.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
b0841eefd9693827afb9888235e26ddd098f9cef , < 3161ef61f121d4573cad5b57c92188dcd9b284b3
(git)
Affected: b0841eefd9693827afb9888235e26ddd098f9cef , < e8ef82cb6443d5f3260b1b830e17f03dda4229ea (git) Affected: b0841eefd9693827afb9888235e26ddd098f9cef , < 4fcfa424a581d823cb1a9676e3eefe6ca17e453a (git) Affected: b0841eefd9693827afb9888235e26ddd098f9cef , < 9a5641024fbfd9b24fe65984ad85fea10a3ae438 (git) Affected: b0841eefd9693827afb9888235e26ddd098f9cef , < 142eacb50fb903a4c10dee7e67b6e79ebb36a582 (git) Affected: b0841eefd9693827afb9888235e26ddd098f9cef , < 14d4ac19d1895397532eec407433c5d74d9da53b (git) Affected: 49824b5c875087a52672b0c8e8ecbefe6f773532 (git) Affected: 09e21253d17f53bdb5aac0e0dbd057a29fcbe8d1 (git) Affected: 0dfc45be875a378c2a3a4d6ed8e668ec8eb75073 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3161ef61f121d4573cad5b57c92188dcd9b284b3",
"status": "affected",
"version": "b0841eefd9693827afb9888235e26ddd098f9cef",
"versionType": "git"
},
{
"lessThan": "e8ef82cb6443d5f3260b1b830e17f03dda4229ea",
"status": "affected",
"version": "b0841eefd9693827afb9888235e26ddd098f9cef",
"versionType": "git"
},
{
"lessThan": "4fcfa424a581d823cb1a9676e3eefe6ca17e453a",
"status": "affected",
"version": "b0841eefd9693827afb9888235e26ddd098f9cef",
"versionType": "git"
},
{
"lessThan": "9a5641024fbfd9b24fe65984ad85fea10a3ae438",
"status": "affected",
"version": "b0841eefd9693827afb9888235e26ddd098f9cef",
"versionType": "git"
},
{
"lessThan": "142eacb50fb903a4c10dee7e67b6e79ebb36a582",
"status": "affected",
"version": "b0841eefd9693827afb9888235e26ddd098f9cef",
"versionType": "git"
},
{
"lessThan": "14d4ac19d1895397532eec407433c5d74d9da53b",
"status": "affected",
"version": "b0841eefd9693827afb9888235e26ddd098f9cef",
"versionType": "git"
},
{
"status": "affected",
"version": "49824b5c875087a52672b0c8e8ecbefe6f773532",
"versionType": "git"
},
{
"status": "affected",
"version": "09e21253d17f53bdb5aac0e0dbd057a29fcbe8d1",
"versionType": "git"
},
{
"status": "affected",
"version": "0dfc45be875a378c2a3a4d6ed8e668ec8eb75073",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.201",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.84",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix recursive locking in __configfs_open_file()\n\nIn flush_write_buffer, \u0026p-\u003efrag_sem is acquired and then the loaded store\nfunction is called, which, here, is target_core_item_dbroot_store(). This\nfunction called filp_open(), following which these functions were called\n(in reverse order), according to the call trace:\n\n down_read\n __configfs_open_file\n do_dentry_open\n vfs_open\n do_open\n path_openat\n do_filp_open\n file_open_name\n filp_open\n target_core_item_dbroot_store\n flush_write_buffer\n configfs_write_iter\n\ntarget_core_item_dbroot_store() tries to validate the new file path by\ntrying to open the file path provided to it; however, in this case, the bug\nreport shows:\n\ndb_root: not a directory: /sys/kernel/config/target/dbroot\n\nindicating that the same configfs file was tried to be opened, on which it\nis currently working on. Thus, it is trying to acquire frag_sem semaphore\nof the same file of which it already holds the semaphore obtained in\nflush_write_buffer(), leading to acquiring the semaphore in a nested manner\nand a possibility of recursive locking.\n\nFix this by modifying target_core_item_dbroot_store() to use kern_path()\ninstead of filp_open() to avoid opening the file using filesystem-specific\nfunction __configfs_open_file(), and further modifying it to make this fix\ncompatible."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:49:12.937Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3161ef61f121d4573cad5b57c92188dcd9b284b3"
},
{
"url": "https://git.kernel.org/stable/c/e8ef82cb6443d5f3260b1b830e17f03dda4229ea"
},
{
"url": "https://git.kernel.org/stable/c/4fcfa424a581d823cb1a9676e3eefe6ca17e453a"
},
{
"url": "https://git.kernel.org/stable/c/9a5641024fbfd9b24fe65984ad85fea10a3ae438"
},
{
"url": "https://git.kernel.org/stable/c/142eacb50fb903a4c10dee7e67b6e79ebb36a582"
},
{
"url": "https://git.kernel.org/stable/c/14d4ac19d1895397532eec407433c5d74d9da53b"
}
],
"title": "scsi: target: Fix recursive locking in __configfs_open_file()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23292",
"datePublished": "2026-03-25T10:26:50.408Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T16:49:12.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23345 (GCVE-0-2026-23345)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled
When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the
shareability attribute with bits 50-51 of the output address. The
_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this
matches the other _PAGE_* definitions) but using this macro directly
leads to the following panic when enabling GCS on a system/model with
LPA2:
Unable to handle kernel paging request at virtual address fffff1ffc32d8008
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000
[fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT
Tainted: [M]=MACHINE_CHECK
Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025
pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : zap_huge_pmd+0x168/0x468
lr : zap_huge_pmd+0x2c/0x468
sp : ffff800080beb660
x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898
x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41
x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000
x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007
x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000
x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff
x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370
x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000
x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600
Call trace:
zap_huge_pmd+0x168/0x468 (P)
unmap_page_range+0xd70/0x1560
unmap_single_vma+0x48/0x80
unmap_vmas+0x90/0x180
unmap_region+0x88/0xe4
vms_complete_munmap_vmas+0xf8/0x1e0
do_vmi_align_munmap+0x158/0x180
do_vmi_munmap+0xac/0x160
__vm_munmap+0xb0/0x138
vm_munmap+0x14/0x20
gcs_free+0x70/0x80
mm_release+0x1c/0xc8
exit_mm_release+0x28/0x38
do_exit+0x190/0x8ec
do_group_exit+0x34/0x90
get_signal+0x794/0x858
arch_do_signal_or_restart+0x11c/0x3e0
exit_to_user_mode_loop+0x10c/0x17c
el0_da+0x8c/0x9c
el0t_64_sync_handler+0xd0/0xf0
el0t_64_sync+0x198/0x19c
Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)
Similarly to how the kernel handles protection_map[], use a
gcs_page_prot variable to store the protection bits and clear PTE_SHARED
if LPA2 is enabled.
Also remove the unused PAGE_GCS{,_RO} macros.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
6497b66ba6945f142902c7e8fce86e47016ead1c , < ca1684dd297bf0725c1d487cff80e615497accf6
(git)
Affected: 6497b66ba6945f142902c7e8fce86e47016ead1c , < 1df3ef7e612d6ccbae5a48e1121553c47c2123d6 (git) Affected: 6497b66ba6945f142902c7e8fce86e47016ead1c , < 8a85b3131225a8c8143ba2ae29c0eef8c1f9117f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/pgtable-prot.h",
"arch/arm64/mm/mmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca1684dd297bf0725c1d487cff80e615497accf6",
"status": "affected",
"version": "6497b66ba6945f142902c7e8fce86e47016ead1c",
"versionType": "git"
},
{
"lessThan": "1df3ef7e612d6ccbae5a48e1121553c47c2123d6",
"status": "affected",
"version": "6497b66ba6945f142902c7e8fce86e47016ead1c",
"versionType": "git"
},
{
"lessThan": "8a85b3131225a8c8143ba2ae29c0eef8c1f9117f",
"status": "affected",
"version": "6497b66ba6945f142902c7e8fce86e47016ead1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/pgtable-prot.h",
"arch/arm64/mm/mmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled\n\nWhen FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the\nshareability attribute with bits 50-51 of the output address. The\n_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this\nmatches the other _PAGE_* definitions) but using this macro directly\nleads to the following panic when enabling GCS on a system/model with\nLPA2:\n\n Unable to handle kernel paging request at virtual address fffff1ffc32d8008\n Mem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Internal error: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT\n Tainted: [M]=MACHINE_CHECK\n Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898\n x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41\n x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000\n x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007\n x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000\n x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff\n x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370\n x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000\n x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600\n Call trace:\n zap_huge_pmd+0x168/0x468 (P)\n unmap_page_range+0xd70/0x1560\n unmap_single_vma+0x48/0x80\n unmap_vmas+0x90/0x180\n unmap_region+0x88/0xe4\n vms_complete_munmap_vmas+0xf8/0x1e0\n do_vmi_align_munmap+0x158/0x180\n do_vmi_munmap+0xac/0x160\n __vm_munmap+0xb0/0x138\n vm_munmap+0x14/0x20\n gcs_free+0x70/0x80\n mm_release+0x1c/0xc8\n exit_mm_release+0x28/0x38\n do_exit+0x190/0x8ec\n do_group_exit+0x34/0x90\n get_signal+0x794/0x858\n arch_do_signal_or_restart+0x11c/0x3e0\n exit_to_user_mode_loop+0x10c/0x17c\n el0_da+0x8c/0x9c\n el0t_64_sync_handler+0xd0/0xf0\n el0t_64_sync+0x198/0x19c\n Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)\n\nSimilarly to how the kernel handles protection_map[], use a\ngcs_page_prot variable to store the protection bits and clear PTE_SHARED\nif LPA2 is enabled.\n\nAlso remove the unused PAGE_GCS{,_RO} macros."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:32.432Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca1684dd297bf0725c1d487cff80e615497accf6"
},
{
"url": "https://git.kernel.org/stable/c/1df3ef7e612d6ccbae5a48e1121553c47c2123d6"
},
{
"url": "https://git.kernel.org/stable/c/8a85b3131225a8c8143ba2ae29c0eef8c1f9117f"
}
],
"title": "arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23345",
"datePublished": "2026-03-25T10:27:32.432Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:32.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23296 (GCVE-0-2026-23296)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
scsi: core: Fix refcount leak for tagset_refcnt
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix refcount leak for tagset_refcnt
This leak will cause a hang when tearing down the SCSI host. For example,
iscsid hangs with the following call trace:
[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured
PID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid"
#0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4
#1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f
#2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0
#3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f
#4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b
#5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]
#6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]
#7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]
#8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6
#9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8fe4ce5836e932f5766317cb651c1ff2a4cd0506 , < 9f5e4abed9248448aa1b45b12ab0bea4d329b56a
(git)
Affected: 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 , < 7c01b680beaf4d3143866b062b8e770e8b237fb8 (git) Affected: 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 , < ec5c17c687b189dbc09dfdec11b669caa40bc395 (git) Affected: 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 , < 944a333c8e4d42256556c1d2ebb6d773a33e0dcd (git) Affected: 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 , < a03d96598d39fdf605d90731db3ef3b13fb8bdc8 (git) Affected: 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 , < 1ac22c8eae81366101597d48360718dff9b9d980 (git) Affected: 5ce8fad941233e81f2afb5b52a3fcddd3ba8732f (git) Affected: f818708eeeae793e12dc39f8984ed7732048a7d9 (git) Affected: 2e7eb4c1e8af8385de22775bd0be552f59b28c9a (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9f5e4abed9248448aa1b45b12ab0bea4d329b56a",
"status": "affected",
"version": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
"versionType": "git"
},
{
"lessThan": "7c01b680beaf4d3143866b062b8e770e8b237fb8",
"status": "affected",
"version": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
"versionType": "git"
},
{
"lessThan": "ec5c17c687b189dbc09dfdec11b669caa40bc395",
"status": "affected",
"version": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
"versionType": "git"
},
{
"lessThan": "944a333c8e4d42256556c1d2ebb6d773a33e0dcd",
"status": "affected",
"version": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
"versionType": "git"
},
{
"lessThan": "a03d96598d39fdf605d90731db3ef3b13fb8bdc8",
"status": "affected",
"version": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
"versionType": "git"
},
{
"lessThan": "1ac22c8eae81366101597d48360718dff9b9d980",
"status": "affected",
"version": "8fe4ce5836e932f5766317cb651c1ff2a4cd0506",
"versionType": "git"
},
{
"status": "affected",
"version": "5ce8fad941233e81f2afb5b52a3fcddd3ba8732f",
"versionType": "git"
},
{
"status": "affected",
"version": "f818708eeeae793e12dc39f8984ed7732048a7d9",
"versionType": "git"
},
{
"status": "affected",
"version": "2e7eb4c1e8af8385de22775bd0be552f59b28c9a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n\n[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured\n\nPID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: \"iscsid\"\n #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4\n #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f\n #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0\n #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f\n #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b\n #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]\n #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]\n #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]\n #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6\n #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:53.509Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9f5e4abed9248448aa1b45b12ab0bea4d329b56a"
},
{
"url": "https://git.kernel.org/stable/c/7c01b680beaf4d3143866b062b8e770e8b237fb8"
},
{
"url": "https://git.kernel.org/stable/c/ec5c17c687b189dbc09dfdec11b669caa40bc395"
},
{
"url": "https://git.kernel.org/stable/c/944a333c8e4d42256556c1d2ebb6d773a33e0dcd"
},
{
"url": "https://git.kernel.org/stable/c/a03d96598d39fdf605d90731db3ef3b13fb8bdc8"
},
{
"url": "https://git.kernel.org/stable/c/1ac22c8eae81366101597d48360718dff9b9d980"
}
],
"title": "scsi: core: Fix refcount leak for tagset_refcnt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23296",
"datePublished": "2026-03-25T10:26:53.509Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:53.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23389 (GCVE-0-2026-23389)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
ice: Fix memory leak in ice_set_ringparam()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix memory leak in ice_set_ringparam()
In ice_set_ringparam, tx_rings and xdp_rings are allocated before
rx_rings. If the allocation of rx_rings fails, the code jumps to
the done label leaking both tx_rings and xdp_rings. Furthermore, if
the setup of an individual Rx ring fails during the loop, the code jumps
to the free_tx label which releases tx_rings but leaks xdp_rings.
Fix this by introducing a free_xdp label and updating the error paths to
ensure both xdp_rings and tx_rings are properly freed if rx_rings
allocation or setup fails.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_ethtool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44ba32a892b72de3faa04b8cfb1f2f1418fdd580",
"status": "affected",
"version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
"versionType": "git"
},
{
"lessThan": "fe868b499d16f55bbeea89992edb98043c9de416",
"status": "affected",
"version": "fcea6f3da546b93050f3534aadea7bd96c1d7349",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_ethtool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix memory leak in ice_set_ringparam()\n\nIn ice_set_ringparam, tx_rings and xdp_rings are allocated before\nrx_rings. If the allocation of rx_rings fails, the code jumps to\nthe done label leaking both tx_rings and xdp_rings. Furthermore, if\nthe setup of an individual Rx ring fails during the loop, the code jumps\nto the free_tx label which releases tx_rings but leaks xdp_rings.\n\nFix this by introducing a free_xdp label and updating the error paths to\nensure both xdp_rings and tx_rings are properly freed if rx_rings\nallocation or setup fails.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:06.991Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44ba32a892b72de3faa04b8cfb1f2f1418fdd580"
},
{
"url": "https://git.kernel.org/stable/c/fe868b499d16f55bbeea89992edb98043c9de416"
}
],
"title": "ice: Fix memory leak in ice_set_ringparam()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23389",
"datePublished": "2026-03-25T10:28:06.991Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T10:28:06.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23312 (GCVE-0-2026-23312)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net: usb: kaweth: validate USB endpoints
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: validate USB endpoints
The kaweth driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7c7ebf5e45d2504d92ea294ac3828d58586491df
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 72f90f481c6a059680b9b976695d4cfb04fba1f3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f33e80d195a003b384620ee240f69092b519146b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2795fc06e7652c0ba299d936c584d5e08b6b57a1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0aae18e4638a7c1c579df92bc6edc36cedfaaa8c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4b063c002ca759d1b299988ee23f564c9609c875 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kaweth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c7ebf5e45d2504d92ea294ac3828d58586491df",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "72f90f481c6a059680b9b976695d4cfb04fba1f3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f33e80d195a003b384620ee240f69092b519146b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2795fc06e7652c0ba299d936c584d5e08b6b57a1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0aae18e4638a7c1c579df92bc6edc36cedfaaa8c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4b063c002ca759d1b299988ee23f564c9609c875",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kaweth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: validate USB endpoints\n\nThe kaweth driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it. If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:07.916Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c7ebf5e45d2504d92ea294ac3828d58586491df"
},
{
"url": "https://git.kernel.org/stable/c/72f90f481c6a059680b9b976695d4cfb04fba1f3"
},
{
"url": "https://git.kernel.org/stable/c/f33e80d195a003b384620ee240f69092b519146b"
},
{
"url": "https://git.kernel.org/stable/c/2795fc06e7652c0ba299d936c584d5e08b6b57a1"
},
{
"url": "https://git.kernel.org/stable/c/0aae18e4638a7c1c579df92bc6edc36cedfaaa8c"
},
{
"url": "https://git.kernel.org/stable/c/4b063c002ca759d1b299988ee23f564c9609c875"
}
],
"title": "net: usb: kaweth: validate USB endpoints",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23312",
"datePublished": "2026-03-25T10:27:07.916Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:07.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23337 (GCVE-0-2026-23337)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns
directly. This bypasses the cleanup logic and results in a memory leak of
the cfg buffer.
Fix this by jumping to the out label on failure, ensuring kfree(cfg) is
called before returning.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/pinconf-generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "63ee429780a5d43b5b4406c6128109b0f47cf2f1",
"status": "affected",
"version": "90a18c512884adb49ddc2fb30e94594169aae808",
"versionType": "git"
},
{
"lessThan": "7a648d598cb8e8c62af3f0e020a25820a3f3a9a7",
"status": "affected",
"version": "90a18c512884adb49ddc2fb30e94594169aae808",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/pinconf-generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()\n\nIn pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns\ndirectly. This bypasses the cleanup logic and results in a memory leak of\nthe cfg buffer.\n\nFix this by jumping to the out label on failure, ensuring kfree(cfg) is\ncalled before returning."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:26.720Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/63ee429780a5d43b5b4406c6128109b0f47cf2f1"
},
{
"url": "https://git.kernel.org/stable/c/7a648d598cb8e8c62af3f0e020a25820a3f3a9a7"
}
],
"title": "pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23337",
"datePublished": "2026-03-25T10:27:26.720Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:26.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23305 (GCVE-0-2026-23305)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
accel/rocket: fix unwinding in error path in rocket_probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix unwinding in error path in rocket_probe
When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
we need to properly unwind by decrementing the counter we just
incremented and if this is the first core we failed to probe, remove the
rocket DRM device with rocket_device_fini() as well. This matches the
logic in rocket_remove(). Failing to properly unwind results in
out-of-bounds accesses.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
0810d5ad88a18f1e6d549853a388ad0316f74e36 , < 7fc4b49474c836cee7d9801abf05e0198fcbfa74
(git)
Affected: 0810d5ad88a18f1e6d549853a388ad0316f74e36 , < eeaf28c8f4defe371a008a5ddefaf18abf534f81 (git) Affected: 0810d5ad88a18f1e6d549853a388ad0316f74e36 , < 34f4495a7f72895776b81969639f527c99eb12b9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/rocket/rocket_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7fc4b49474c836cee7d9801abf05e0198fcbfa74",
"status": "affected",
"version": "0810d5ad88a18f1e6d549853a388ad0316f74e36",
"versionType": "git"
},
{
"lessThan": "eeaf28c8f4defe371a008a5ddefaf18abf534f81",
"status": "affected",
"version": "0810d5ad88a18f1e6d549853a388ad0316f74e36",
"versionType": "git"
},
{
"lessThan": "34f4495a7f72895776b81969639f527c99eb12b9",
"status": "affected",
"version": "0810d5ad88a18f1e6d549853a388ad0316f74e36",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/rocket/rocket_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc1",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: fix unwinding in error path in rocket_probe\n\nWhen rocket_core_init() fails (as could be the case with EPROBE_DEFER),\nwe need to properly unwind by decrementing the counter we just\nincremented and if this is the first core we failed to probe, remove the\nrocket DRM device with rocket_device_fini() as well. This matches the\nlogic in rocket_remove(). Failing to properly unwind results in\nout-of-bounds accesses."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:00.612Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7fc4b49474c836cee7d9801abf05e0198fcbfa74"
},
{
"url": "https://git.kernel.org/stable/c/eeaf28c8f4defe371a008a5ddefaf18abf534f81"
},
{
"url": "https://git.kernel.org/stable/c/34f4495a7f72895776b81969639f527c99eb12b9"
}
],
"title": "accel/rocket: fix unwinding in error path in rocket_probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23305",
"datePublished": "2026-03-25T10:27:00.612Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:27:00.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23279 (GCVE-0-2026-23279)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced
at lines 1638 and 1642 without a prior NULL check:
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
...
pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
The mesh_matches_local() check above only validates the Mesh ID,
Mesh Configuration, and Supported Rates IEs. It does not verify the
presence of the Mesh Channel Switch Parameters IE (element ID 118).
When a received CSA action frame omits that IE, ieee802_11_parse_elems()
leaves elems->mesh_chansw_params_ie as NULL, and the unconditional
dereference causes a kernel NULL pointer dereference.
A remote mesh peer with an established peer link (PLINK_ESTAB) can
trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame
that includes a matching Mesh ID and Mesh Configuration IE but omits the
Mesh Channel Switch Parameters IE. No authentication beyond the default
open mesh peering is required.
Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]
CR2: 0000000000000000
Fix by adding a NULL check for mesh_chansw_params_ie after
mesh_matches_local() returns, consistent with how other optional IEs
are guarded throughout the mesh code.
The bug has been present since v3.13 (released 2014-01-19).
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab
(git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 22a9adea7e26d236406edc0ea00b54351dd56b9c (git) Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < f5d8af683410a8c82e48b51291915bd612523d9a (git) Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < cc6d5a3c0a854aeae00915fc5386570c86029c60 (git) Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < be8b82c567fda86f2cbb43b7208825125bb31421 (git) Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 017c1792525064a723971f0216e6ef86a8c7af11 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/mesh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab",
"status": "affected",
"version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
"versionType": "git"
},
{
"lessThan": "22a9adea7e26d236406edc0ea00b54351dd56b9c",
"status": "affected",
"version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
"versionType": "git"
},
{
"lessThan": "f5d8af683410a8c82e48b51291915bd612523d9a",
"status": "affected",
"version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
"versionType": "git"
},
{
"lessThan": "cc6d5a3c0a854aeae00915fc5386570c86029c60",
"status": "affected",
"version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
"versionType": "git"
},
{
"lessThan": "be8b82c567fda86f2cbb43b7208825125bb31421",
"status": "affected",
"version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
"versionType": "git"
},
{
"lessThan": "017c1792525064a723971f0216e6ef86a8c7af11",
"status": "affected",
"version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/mesh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()\n\nIn mesh_rx_csa_frame(), elems-\u003emesh_chansw_params_ie is dereferenced\nat lines 1638 and 1642 without a prior NULL check:\n\n ifmsh-\u003echsw_ttl = elems-\u003emesh_chansw_params_ie-\u003emesh_ttl;\n ...\n pre_value = le16_to_cpu(elems-\u003emesh_chansw_params_ie-\u003emesh_pre_value);\n\nThe mesh_matches_local() check above only validates the Mesh ID,\nMesh Configuration, and Supported Rates IEs. It does not verify the\npresence of the Mesh Channel Switch Parameters IE (element ID 118).\nWhen a received CSA action frame omits that IE, ieee802_11_parse_elems()\nleaves elems-\u003emesh_chansw_params_ie as NULL, and the unconditional\ndereference causes a kernel NULL pointer dereference.\n\nA remote mesh peer with an established peer link (PLINK_ESTAB) can\ntrigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame\nthat includes a matching Mesh ID and Mesh Configuration IE but omits the\nMesh Channel Switch Parameters IE. No authentication beyond the default\nopen mesh peering is required.\n\nCrash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]\n CR2: 0000000000000000\n\nFix by adding a NULL check for mesh_chansw_params_ie after\nmesh_matches_local() returns, consistent with how other optional IEs\nare guarded throughout the mesh code.\n\nThe bug has been present since v3.13 (released 2014-01-19)."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:39.994Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab"
},
{
"url": "https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c"
},
{
"url": "https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a"
},
{
"url": "https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60"
},
{
"url": "https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421"
},
{
"url": "https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11"
}
],
"title": "wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23279",
"datePublished": "2026-03-25T10:26:39.994Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:39.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23330 (GCVE-0-2026-23330)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
nfc: nci: complete pending data exchange on device close
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: complete pending data exchange on device close
In nci_close_device(), complete any pending data exchange before
closing. The data exchange callback (e.g.
rawsock_data_exchange_complete) holds a socket reference.
NIPA occasionally hits this leak:
unreferenced object 0xff1100000f435000 (size 2048):
comm "nci_dev", pid 3954, jiffies 4295441245
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc ec2b3c5):
__kmalloc_noprof+0x4db/0x730
sk_prot_alloc.isra.0+0xe4/0x1d0
sk_alloc+0x36/0x760
rawsock_create+0xd1/0x540
nfc_sock_create+0x11f/0x280
__sock_create+0x22d/0x630
__sys_socket+0x115/0x1d0
__x64_sys_socket+0x72/0xd0
do_syscall_64+0x117/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
38f04c6b1b682f1879441e2925403ad9aff9e229 , < 91ff0d8c3464da7f0c43da38c195e60b660128bf
(git)
Affected: 38f04c6b1b682f1879441e2925403ad9aff9e229 , < d05f55d68ebdebb2b0a8480d766eaae88c8c92de (git) Affected: 38f04c6b1b682f1879441e2925403ad9aff9e229 , < 66083581945bd5b8e99fe49b5aeb83d03f62d053 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91ff0d8c3464da7f0c43da38c195e60b660128bf",
"status": "affected",
"version": "38f04c6b1b682f1879441e2925403ad9aff9e229",
"versionType": "git"
},
{
"lessThan": "d05f55d68ebdebb2b0a8480d766eaae88c8c92de",
"status": "affected",
"version": "38f04c6b1b682f1879441e2925403ad9aff9e229",
"versionType": "git"
},
{
"lessThan": "66083581945bd5b8e99fe49b5aeb83d03f62d053",
"status": "affected",
"version": "38f04c6b1b682f1879441e2925403ad9aff9e229",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: complete pending data exchange on device close\n\nIn nci_close_device(), complete any pending data exchange before\nclosing. The data exchange callback (e.g.\nrawsock_data_exchange_complete) holds a socket reference.\n\nNIPA occasionally hits this leak:\n\nunreferenced object 0xff1100000f435000 (size 2048):\n comm \"nci_dev\", pid 3954, jiffies 4295441245\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 \u0027..@............\n backtrace (crc ec2b3c5):\n __kmalloc_noprof+0x4db/0x730\n sk_prot_alloc.isra.0+0xe4/0x1d0\n sk_alloc+0x36/0x760\n rawsock_create+0xd1/0x540\n nfc_sock_create+0x11f/0x280\n __sock_create+0x22d/0x630\n __sys_socket+0x115/0x1d0\n __x64_sys_socket+0x72/0xd0\n do_syscall_64+0x117/0xfc0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:21.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91ff0d8c3464da7f0c43da38c195e60b660128bf"
},
{
"url": "https://git.kernel.org/stable/c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de"
},
{
"url": "https://git.kernel.org/stable/c/66083581945bd5b8e99fe49b5aeb83d03f62d053"
}
],
"title": "nfc: nci: complete pending data exchange on device close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23330",
"datePublished": "2026-03-25T10:27:21.871Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:21.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23331 (GCVE-0-2026-23331)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
Summary
In the Linux kernel, the following vulnerability has been resolved:
udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
Let's say we bind() an UDP socket to the wildcard address with a
non-zero port, connect() it to an address, and disconnect it from
the address.
bind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not
SOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put
the socket into the 4-tuple hash table.
Then, __udp_disconnect() calls sk->sk_prot->rehash(sk).
It computes a new hash based on the wildcard address and moves
the socket to a new slot in the 4-tuple hash table, leaving a
garbage in the chain that no packet hits.
Let's remove such a socket from 4-tuple hash table when disconnected.
Note that udp_sk(sk)->udp_portaddr_hash needs to be udpated after
udp_hash4_dec(hslot2) in udp_unhash4().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
78c91ae2c6deb5d236a5a93ff2995cdd05514380 , < b955350778b8715e1b7885179979b3a68221c0fb
(git)
Affected: 78c91ae2c6deb5d236a5a93ff2995cdd05514380 , < 3b8f104880c104151f8c30f2f89df81fb59a286c (git) Affected: 78c91ae2c6deb5d236a5a93ff2995cdd05514380 , < 6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b955350778b8715e1b7885179979b3a68221c0fb",
"status": "affected",
"version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380",
"versionType": "git"
},
{
"lessThan": "3b8f104880c104151f8c30f2f89df81fb59a286c",
"status": "affected",
"version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380",
"versionType": "git"
},
{
"lessThan": "6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4",
"status": "affected",
"version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.\n\nLet\u0027s say we bind() an UDP socket to the wildcard address with a\nnon-zero port, connect() it to an address, and disconnect it from\nthe address.\n\nbind() sets SOCK_BINDPORT_LOCK on sk-\u003esk_userlocks (but not\nSOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put\nthe socket into the 4-tuple hash table.\n\nThen, __udp_disconnect() calls sk-\u003esk_prot-\u003erehash(sk).\n\nIt computes a new hash based on the wildcard address and moves\nthe socket to a new slot in the 4-tuple hash table, leaving a\ngarbage in the chain that no packet hits.\n\nLet\u0027s remove such a socket from 4-tuple hash table when disconnected.\n\nNote that udp_sk(sk)-\u003eudp_portaddr_hash needs to be udpated after\nudp_hash4_dec(hslot2) in udp_unhash4()."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:22.526Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b955350778b8715e1b7885179979b3a68221c0fb"
},
{
"url": "https://git.kernel.org/stable/c/3b8f104880c104151f8c30f2f89df81fb59a286c"
},
{
"url": "https://git.kernel.org/stable/c/6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4"
}
],
"title": "udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23331",
"datePublished": "2026-03-25T10:27:22.526Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:22.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23304 (GCVE-0-2026-23304)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
l3mdev_master_dev_rcu() can return NULL when the slave device is being
un-slaved from a VRF. All other callers deal with this, but we lost
the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu()
with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on
device with address").
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)
Call Trace:
ip6_pol_route (net/ipv6/route.c:2318)
fib6_rule_lookup (net/ipv6/fib6_rules.c:115)
ip6_route_output_flags (net/ipv6/route.c:2607)
vrf_process_v6_outbound (drivers/net/vrf.c:437)
I was tempted to rework the un-slaving code to clear the flag first
and insert synchronize_rcu() before we remove the upper. But looks like
the explicit fallback to loopback_dev is an established pattern.
And I guess avoiding the synchronize_rcu() is nice, too.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
4832c30d5458387ff2533ff66fbde26ad8bb5a2d , < 4a48fe59f29f673a3d042d679f26629a9c3e29d4
(git)
Affected: 4832c30d5458387ff2533ff66fbde26ad8bb5a2d , < 581800298313c9fd75e94985e6d37d21b7e35d34 (git) Affected: 4832c30d5458387ff2533ff66fbde26ad8bb5a2d , < 3310fc11fc47387d1dd4759b0bc961643ea11c7f (git) Affected: 4832c30d5458387ff2533ff66fbde26ad8bb5a2d , < 0b5a7826020706057cc5a9d9009e667027f221ee (git) Affected: 4832c30d5458387ff2533ff66fbde26ad8bb5a2d , < ae88c8256547b63980770a9ea7be73a15900d27e (git) Affected: 4832c30d5458387ff2533ff66fbde26ad8bb5a2d , < 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a48fe59f29f673a3d042d679f26629a9c3e29d4",
"status": "affected",
"version": "4832c30d5458387ff2533ff66fbde26ad8bb5a2d",
"versionType": "git"
},
{
"lessThan": "581800298313c9fd75e94985e6d37d21b7e35d34",
"status": "affected",
"version": "4832c30d5458387ff2533ff66fbde26ad8bb5a2d",
"versionType": "git"
},
{
"lessThan": "3310fc11fc47387d1dd4759b0bc961643ea11c7f",
"status": "affected",
"version": "4832c30d5458387ff2533ff66fbde26ad8bb5a2d",
"versionType": "git"
},
{
"lessThan": "0b5a7826020706057cc5a9d9009e667027f221ee",
"status": "affected",
"version": "4832c30d5458387ff2533ff66fbde26ad8bb5a2d",
"versionType": "git"
},
{
"lessThan": "ae88c8256547b63980770a9ea7be73a15900d27e",
"status": "affected",
"version": "4832c30d5458387ff2533ff66fbde26ad8bb5a2d",
"versionType": "git"
},
{
"lessThan": "2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a",
"status": "affected",
"version": "4832c30d5458387ff2533ff66fbde26ad8bb5a2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()\n\nl3mdev_master_dev_rcu() can return NULL when the slave device is being\nun-slaved from a VRF. All other callers deal with this, but we lost\nthe fallback to loopback in ip6_rt_pcpu_alloc() -\u003e ip6_rt_get_dev_rcu()\nwith commit 4832c30d5458 (\"net: ipv6: put host and anycast routes on\ndevice with address\").\n\n KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)\n Call Trace:\n ip6_pol_route (net/ipv6/route.c:2318)\n fib6_rule_lookup (net/ipv6/fib6_rules.c:115)\n ip6_route_output_flags (net/ipv6/route.c:2607)\n vrf_process_v6_outbound (drivers/net/vrf.c:437)\n\nI was tempted to rework the un-slaving code to clear the flag first\nand insert synchronize_rcu() before we remove the upper. But looks like\nthe explicit fallback to loopback_dev is an established pattern.\nAnd I guess avoiding the synchronize_rcu() is nice, too."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:59.015Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a48fe59f29f673a3d042d679f26629a9c3e29d4"
},
{
"url": "https://git.kernel.org/stable/c/581800298313c9fd75e94985e6d37d21b7e35d34"
},
{
"url": "https://git.kernel.org/stable/c/3310fc11fc47387d1dd4759b0bc961643ea11c7f"
},
{
"url": "https://git.kernel.org/stable/c/0b5a7826020706057cc5a9d9009e667027f221ee"
},
{
"url": "https://git.kernel.org/stable/c/ae88c8256547b63980770a9ea7be73a15900d27e"
},
{
"url": "https://git.kernel.org/stable/c/2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a"
}
],
"title": "ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23304",
"datePublished": "2026-03-25T10:26:59.015Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:59.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23322 (GCVE-0-2026-23322)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
ipmi: Fix use-after-free and list corruption on sender error
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Fix use-after-free and list corruption on sender error
The analysis from Breno:
When the SMI sender returns an error, smi_work() delivers an error
response but then jumps back to restart without cleaning up properly:
1. intf->curr_msg is not cleared, so no new message is pulled
2. newmsg still points to the message, causing sender() to be called
again with the same message
3. If sender() fails again, deliver_err_response() is called with
the same recv_msg that was already queued for delivery
This causes list_add corruption ("list_add double add") because the
recv_msg is added to the user_msgs list twice. Subsequently, the
corrupted list leads to use-after-free when the memory is freed and
reused, and eventually a NULL pointer dereference when accessing
recv_msg->done.
The buggy sequence:
sender() fails
-> deliver_err_response(recv_msg) // recv_msg queued for delivery
-> goto restart // curr_msg not cleared!
sender() fails again (same message!)
-> deliver_err_response(recv_msg) // tries to queue same recv_msg
-> LIST CORRUPTION
Fix this by freeing the message and setting it to NULL on a send error.
Also, always free the newmsg on a send error, otherwise it will leak.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 , < c08ec55617cb9674a060a3392ea08391ab2a4f74
(git)
Affected: 9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 , < 65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53 (git) Affected: 9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 , < 594c11d0e1d445f580898a2b8c850f2e3f099368 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_msghandler.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c08ec55617cb9674a060a3392ea08391ab2a4f74",
"status": "affected",
"version": "9cf93a8fa9513c6d3cc65bdd50e05c1355cef322",
"versionType": "git"
},
{
"lessThan": "65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53",
"status": "affected",
"version": "9cf93a8fa9513c6d3cc65bdd50e05c1355cef322",
"versionType": "git"
},
{
"lessThan": "594c11d0e1d445f580898a2b8c850f2e3f099368",
"status": "affected",
"version": "9cf93a8fa9513c6d3cc65bdd50e05c1355cef322",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_msghandler.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix use-after-free and list corruption on sender error\n\nThe analysis from Breno:\n\nWhen the SMI sender returns an error, smi_work() delivers an error\nresponse but then jumps back to restart without cleaning up properly:\n\n1. intf-\u003ecurr_msg is not cleared, so no new message is pulled\n2. newmsg still points to the message, causing sender() to be called\n again with the same message\n3. If sender() fails again, deliver_err_response() is called with\n the same recv_msg that was already queued for delivery\n\nThis causes list_add corruption (\"list_add double add\") because the\nrecv_msg is added to the user_msgs list twice. Subsequently, the\ncorrupted list leads to use-after-free when the memory is freed and\nreused, and eventually a NULL pointer dereference when accessing\nrecv_msg-\u003edone.\n\nThe buggy sequence:\n\n sender() fails\n -\u003e deliver_err_response(recv_msg) // recv_msg queued for delivery\n -\u003e goto restart // curr_msg not cleared!\n sender() fails again (same message!)\n -\u003e deliver_err_response(recv_msg) // tries to queue same recv_msg\n -\u003e LIST CORRUPTION\n\nFix this by freeing the message and setting it to NULL on a send error.\nAlso, always free the newmsg on a send error, otherwise it will leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:15.954Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c08ec55617cb9674a060a3392ea08391ab2a4f74"
},
{
"url": "https://git.kernel.org/stable/c/65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53"
},
{
"url": "https://git.kernel.org/stable/c/594c11d0e1d445f580898a2b8c850f2e3f099368"
}
],
"title": "ipmi: Fix use-after-free and list corruption on sender error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23322",
"datePublished": "2026-03-25T10:27:15.954Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:15.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23283 (GCVE-0-2026-23283)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()
In fp9931_hwmon_read(), if regmap_read() failed, the function returned
the error code without calling pm_runtime_put_autosuspend(), causing
a PM reference leak.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/regulator/fp9931.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ada571018d54c2381bab7c290577114f9667cda7",
"status": "affected",
"version": "12d821bd13d42e6de3ecb1c13918b1f06a3ee213",
"versionType": "git"
},
{
"lessThan": "0902010c8d163f7b62e655efda1a843529152c7c",
"status": "affected",
"version": "12d821bd13d42e6de3ecb1c13918b1f06a3ee213",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/regulator/fp9931.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()\n\nIn fp9931_hwmon_read(), if regmap_read() failed, the function returned\nthe error code without calling pm_runtime_put_autosuspend(), causing\na PM reference leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:43.316Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ada571018d54c2381bab7c290577114f9667cda7"
},
{
"url": "https://git.kernel.org/stable/c/0902010c8d163f7b62e655efda1a843529152c7c"
}
],
"title": "regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23283",
"datePublished": "2026-03-25T10:26:43.316Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:43.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23379 (GCVE-0-2026-23379)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net/sched: ets: fix divide by zero in the offload path
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: fix divide by zero in the offload path
Offloading ETS requires computing each class' WRR weight: this is done by
averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned
int, the same integer size as the individual DRR quanta, can overflow and
even cause division by zero, like it happened in the following splat:
Oops: divide error: 0000 [#1] SMP PTI
CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full)
Tainted: [E]=UNSIGNED_MODULE
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44
RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246
RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660
RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000
FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0
Call Trace:
<TASK>
ets_qdisc_change+0x870/0xf40 [sch_ets]
qdisc_create+0x12b/0x540
tc_modify_qdisc+0x6d7/0xbd0
rtnetlink_rcv_msg+0x168/0x6b0
netlink_rcv_skb+0x5c/0x110
netlink_unicast+0x1d6/0x2b0
netlink_sendmsg+0x22e/0x470
____sys_sendmsg+0x38a/0x3c0
___sys_sendmsg+0x99/0xe0
__sys_sendmsg+0x8a/0xf0
do_syscall_64+0x111/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f440b81c77e
Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e
RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003
RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8
R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980
</TASK>
Modules linked in: sch_ets(E) netdevsim(E)
---[ end trace 0000000000000000 ]---
RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]
Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44
RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246
RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660
RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe
R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000
FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception ]---
Fix this using 64-bit integers for 'q_sum' and 'q_psum'.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d35eb52bd2ac7557b62bda52668f2e64dde2cf90 , < 3912871344d6a0f1f572a7af2716968182d1e536
(git)
Affected: d35eb52bd2ac7557b62bda52668f2e64dde2cf90 , < 7dbffffd5761687e168fb2f4aaa7a2c47e067efc (git) Affected: d35eb52bd2ac7557b62bda52668f2e64dde2cf90 , < 78b8d2f55a564236435649fbd8bd6a103f30acf5 (git) Affected: d35eb52bd2ac7557b62bda52668f2e64dde2cf90 , < a6677e23b313cd9fd03690c589c6452cb6fffb97 (git) Affected: d35eb52bd2ac7557b62bda52668f2e64dde2cf90 , < abe1d5cb7fe135c0862c58db32bc29e04cf1c906 (git) Affected: d35eb52bd2ac7557b62bda52668f2e64dde2cf90 , < e35626f610f3d2b7953ccddf6a77453da22b3a9e (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_ets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3912871344d6a0f1f572a7af2716968182d1e536",
"status": "affected",
"version": "d35eb52bd2ac7557b62bda52668f2e64dde2cf90",
"versionType": "git"
},
{
"lessThan": "7dbffffd5761687e168fb2f4aaa7a2c47e067efc",
"status": "affected",
"version": "d35eb52bd2ac7557b62bda52668f2e64dde2cf90",
"versionType": "git"
},
{
"lessThan": "78b8d2f55a564236435649fbd8bd6a103f30acf5",
"status": "affected",
"version": "d35eb52bd2ac7557b62bda52668f2e64dde2cf90",
"versionType": "git"
},
{
"lessThan": "a6677e23b313cd9fd03690c589c6452cb6fffb97",
"status": "affected",
"version": "d35eb52bd2ac7557b62bda52668f2e64dde2cf90",
"versionType": "git"
},
{
"lessThan": "abe1d5cb7fe135c0862c58db32bc29e04cf1c906",
"status": "affected",
"version": "d35eb52bd2ac7557b62bda52668f2e64dde2cf90",
"versionType": "git"
},
{
"lessThan": "e35626f610f3d2b7953ccddf6a77453da22b3a9e",
"status": "affected",
"version": "d35eb52bd2ac7557b62bda52668f2e64dde2cf90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_ets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: fix divide by zero in the offload path\n\nOffloading ETS requires computing each class\u0027 WRR weight: this is done by\naveraging over the sums of quanta as \u0027q_sum\u0027 and \u0027q_psum\u0027. Using unsigned\nint, the same integer size as the individual DRR quanta, can overflow and\neven cause division by zero, like it happened in the following splat:\n\n Oops: divide error: 0000 [#1] SMP PTI\n CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full)\n Tainted: [E]=UNSIGNED_MODULE\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]\n Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 \u003c41\u003e f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44\n RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246\n RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660\n RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe\n R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe\n R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000\n FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0\n Call Trace:\n \u003cTASK\u003e\n ets_qdisc_change+0x870/0xf40 [sch_ets]\n qdisc_create+0x12b/0x540\n tc_modify_qdisc+0x6d7/0xbd0\n rtnetlink_rcv_msg+0x168/0x6b0\n netlink_rcv_skb+0x5c/0x110\n netlink_unicast+0x1d6/0x2b0\n netlink_sendmsg+0x22e/0x470\n ____sys_sendmsg+0x38a/0x3c0\n ___sys_sendmsg+0x99/0xe0\n __sys_sendmsg+0x8a/0xf0\n do_syscall_64+0x111/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f440b81c77e\n Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 \u003cc9\u003e c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa\n RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e\n RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003\n RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8\n R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980\n \u003c/TASK\u003e\n Modules linked in: sch_ets(E) netdevsim(E)\n ---[ end trace 0000000000000000 ]---\n RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets]\n Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 \u003c41\u003e f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44\n RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246\n RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660\n RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe\n R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe\n R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000\n FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0\n Kernel panic - not syncing: Fatal exception\n Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n ---[ end Kernel panic - not syncing: Fatal exception ]---\n\nFix this using 64-bit integers for \u0027q_sum\u0027 and \u0027q_psum\u0027."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:58.659Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3912871344d6a0f1f572a7af2716968182d1e536"
},
{
"url": "https://git.kernel.org/stable/c/7dbffffd5761687e168fb2f4aaa7a2c47e067efc"
},
{
"url": "https://git.kernel.org/stable/c/78b8d2f55a564236435649fbd8bd6a103f30acf5"
},
{
"url": "https://git.kernel.org/stable/c/a6677e23b313cd9fd03690c589c6452cb6fffb97"
},
{
"url": "https://git.kernel.org/stable/c/abe1d5cb7fe135c0862c58db32bc29e04cf1c906"
},
{
"url": "https://git.kernel.org/stable/c/e35626f610f3d2b7953ccddf6a77453da22b3a9e"
}
],
"title": "net/sched: ets: fix divide by zero in the offload path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23379",
"datePublished": "2026-03-25T10:27:58.659Z",
"dateReserved": "2026-01-13T15:37:46.006Z",
"dateUpdated": "2026-03-25T10:27:58.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23299 (GCVE-0-2026-23299)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
Bluetooth: purge error queues in socket destructors
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: purge error queues in socket destructors
When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued
into sk_error_queue and will stay there until consumed. If userspace never
gets to read the timestamps, or if the controller is removed unexpectedly,
these SKBs will leak.
Fix by adding skb_queue_purge() calls for sk_error_queue in affected
bluetooth destructors. RFCOMM does not currently use sk_error_queue.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
134f4b39df7b77225a80ef585c15d46f964f5e6f , < 2b6c942a526635f5c61d2f000258e620da32d3a7
(git)
Affected: 134f4b39df7b77225a80ef585c15d46f964f5e6f , < 3de7c10a950b36affc692d8bd2ac713852580e56 (git) Affected: 134f4b39df7b77225a80ef585c15d46f964f5e6f , < 21e4271e65094172aadd5beb8caea95dd0fbf6d7 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sock.c",
"net/bluetooth/iso.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2b6c942a526635f5c61d2f000258e620da32d3a7",
"status": "affected",
"version": "134f4b39df7b77225a80ef585c15d46f964f5e6f",
"versionType": "git"
},
{
"lessThan": "3de7c10a950b36affc692d8bd2ac713852580e56",
"status": "affected",
"version": "134f4b39df7b77225a80ef585c15d46f964f5e6f",
"versionType": "git"
},
{
"lessThan": "21e4271e65094172aadd5beb8caea95dd0fbf6d7",
"status": "affected",
"version": "134f4b39df7b77225a80ef585c15d46f964f5e6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sock.c",
"net/bluetooth/iso.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: purge error queues in socket destructors\n\nWhen TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued\ninto sk_error_queue and will stay there until consumed. If userspace never\ngets to read the timestamps, or if the controller is removed unexpectedly,\nthese SKBs will leak.\n\nFix by adding skb_queue_purge() calls for sk_error_queue in affected\nbluetooth destructors. RFCOMM does not currently use sk_error_queue."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:55.481Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7"
},
{
"url": "https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56"
},
{
"url": "https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7"
}
],
"title": "Bluetooth: purge error queues in socket destructors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23299",
"datePublished": "2026-03-25T10:26:55.481Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:55.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23307 (GCVE-0-2026-23307)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
When looking at the data in a USB urb, the actual_length is the size of
the buffer passed to the driver, not the transfer_buffer_length which is
set by the driver as the max size of the buffer.
When parsing the messages in ems_usb_read_bulk_callback() properly check
the size both at the beginning of parsing the message to make sure it is
big enough for the expected structure, and at the end of the message to
make sure we don't overflow past the end of the buffer for the next
message.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
702171adeed3607ee9603ec30ce081411e36ae42 , < c703bbf8e9b4947e111c88d2ed09236a6772a471
(git)
Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 1818974e1b5ef200e27f144c8cb8a246420bb54d (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 18f75b9cbdc3703f15965425ab69dee509b07785 (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 1cf469026d4a2308eaa91d04dca4a900d07a5c2e (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 2833e13e2b099546abf5d40a483b4eb04ddd1f7b (git) Affected: 702171adeed3607ee9603ec30ce081411e36ae42 , < 38a01c9700b0dcafe97dfa9dc7531bf4a245deff (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ems_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c703bbf8e9b4947e111c88d2ed09236a6772a471",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "1818974e1b5ef200e27f144c8cb8a246420bb54d",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "18f75b9cbdc3703f15965425ab69dee509b07785",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "1cf469026d4a2308eaa91d04dca4a900d07a5c2e",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "2833e13e2b099546abf5d40a483b4eb04ddd1f7b",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
},
{
"lessThan": "38a01c9700b0dcafe97dfa9dc7531bf4a245deff",
"status": "affected",
"version": "702171adeed3607ee9603ec30ce081411e36ae42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ems_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message\n\nWhen looking at the data in a USB urb, the actual_length is the size of\nthe buffer passed to the driver, not the transfer_buffer_length which is\nset by the driver as the max size of the buffer.\n\nWhen parsing the messages in ems_usb_read_bulk_callback() properly check\nthe size both at the beginning of parsing the message to make sure it is\nbig enough for the expected structure, and at the end of the message to\nmake sure we don\u0027t overflow past the end of the buffer for the next\nmessage."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:02.746Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c703bbf8e9b4947e111c88d2ed09236a6772a471"
},
{
"url": "https://git.kernel.org/stable/c/1818974e1b5ef200e27f144c8cb8a246420bb54d"
},
{
"url": "https://git.kernel.org/stable/c/18f75b9cbdc3703f15965425ab69dee509b07785"
},
{
"url": "https://git.kernel.org/stable/c/1cf469026d4a2308eaa91d04dca4a900d07a5c2e"
},
{
"url": "https://git.kernel.org/stable/c/2833e13e2b099546abf5d40a483b4eb04ddd1f7b"
},
{
"url": "https://git.kernel.org/stable/c/38a01c9700b0dcafe97dfa9dc7531bf4a245deff"
}
],
"title": "can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23307",
"datePublished": "2026-03-25T10:27:02.746Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:02.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23391 (GCVE-0-2026-23391)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:33 – Updated: 2026-03-25 10:33
VLAI?
EPSS
Title
netfilter: xt_CT: drop pending enqueued packets on template removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_CT: drop pending enqueued packets on template removal
Templates refer to objects that can go away while packets are sitting in
nfqueue refer to:
- helper, this can be an issue on module removal.
- timeout policy, nfnetlink_cttimeout might remove it.
The use of templates with zone and event cache filter are safe, since
this just copies values.
Flush these enqueued packets in case the template rule gets removed.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
24de58f465165298aaa8f286b2592f0163706cfe , < d2d0bae0c9a2a17b6990a2966f5cdce0813d6256
(git)
Affected: 24de58f465165298aaa8f286b2592f0163706cfe , < 63b8097cea1923fe82cd598068d0796da8c015ec (git) Affected: 24de58f465165298aaa8f286b2592f0163706cfe , < 19a230dec6bb8928e3f96387f9085cf2c79bcef9 (git) Affected: 24de58f465165298aaa8f286b2592f0163706cfe , < cb549925875fa06dd155e49db4ac2c5044c30f9c (git) Affected: 24de58f465165298aaa8f286b2592f0163706cfe , < 777d02efe3d630cca4c1b63962cec17c57711325 (git) Affected: 24de58f465165298aaa8f286b2592f0163706cfe , < f62a218a946b19bb59abdd5361da85fa4606b96b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_CT.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2d0bae0c9a2a17b6990a2966f5cdce0813d6256",
"status": "affected",
"version": "24de58f465165298aaa8f286b2592f0163706cfe",
"versionType": "git"
},
{
"lessThan": "63b8097cea1923fe82cd598068d0796da8c015ec",
"status": "affected",
"version": "24de58f465165298aaa8f286b2592f0163706cfe",
"versionType": "git"
},
{
"lessThan": "19a230dec6bb8928e3f96387f9085cf2c79bcef9",
"status": "affected",
"version": "24de58f465165298aaa8f286b2592f0163706cfe",
"versionType": "git"
},
{
"lessThan": "cb549925875fa06dd155e49db4ac2c5044c30f9c",
"status": "affected",
"version": "24de58f465165298aaa8f286b2592f0163706cfe",
"versionType": "git"
},
{
"lessThan": "777d02efe3d630cca4c1b63962cec17c57711325",
"status": "affected",
"version": "24de58f465165298aaa8f286b2592f0163706cfe",
"versionType": "git"
},
{
"lessThan": "f62a218a946b19bb59abdd5361da85fa4606b96b",
"status": "affected",
"version": "24de58f465165298aaa8f286b2592f0163706cfe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_CT.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc5",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_CT: drop pending enqueued packets on template removal\n\nTemplates refer to objects that can go away while packets are sitting in\nnfqueue refer to:\n\n- helper, this can be an issue on module removal.\n- timeout policy, nfnetlink_cttimeout might remove it.\n\nThe use of templates with zone and event cache filter are safe, since\nthis just copies values.\n\nFlush these enqueued packets in case the template rule gets removed."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:33:15.677Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2d0bae0c9a2a17b6990a2966f5cdce0813d6256"
},
{
"url": "https://git.kernel.org/stable/c/63b8097cea1923fe82cd598068d0796da8c015ec"
},
{
"url": "https://git.kernel.org/stable/c/19a230dec6bb8928e3f96387f9085cf2c79bcef9"
},
{
"url": "https://git.kernel.org/stable/c/cb549925875fa06dd155e49db4ac2c5044c30f9c"
},
{
"url": "https://git.kernel.org/stable/c/777d02efe3d630cca4c1b63962cec17c57711325"
},
{
"url": "https://git.kernel.org/stable/c/f62a218a946b19bb59abdd5361da85fa4606b96b"
}
],
"title": "netfilter: xt_CT: drop pending enqueued packets on template removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23391",
"datePublished": "2026-03-25T10:33:15.677Z",
"dateReserved": "2026-01-13T15:37:46.009Z",
"dateUpdated": "2026-03-25T10:33:15.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23355 (GCVE-0-2026-23355)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
ata: libata: cancel pending work after clearing deferred_qc
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: libata: cancel pending work after clearing deferred_qc
Syzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by
ap->ops->qc_defer() returning non-zero before issuing the deferred qc.
ata_scsi_schedule_deferred_qc() is called during each command completion.
This function will check if there is a deferred QC, and if
ap->ops->qc_defer() returns zero, meaning that it is possible to queue the
deferred qc at this time (without being deferred), then it will queue the
work which will issue the deferred qc.
Once the work get to run, which can potentially be a very long time after
the work was scheduled, there is a WARN_ON() if ap->ops->qc_defer() returns
non-zero.
While we hold the ap->lock both when assigning and clearing deferred_qc,
and the work itself holds the ap->lock, the code currently does not cancel
the work after clearing the deferred qc.
This means that the following scenario can happen:
1) One or several NCQ commands are queued.
2) A non-NCQ command is queued, gets stored in ap->deferred_qc.
3) Last NCQ command gets completed, work is queued to issue the deferred
qc.
4) Timeout or error happens, ap->deferred_qc is cleared. The queued work is
currently NOT canceled.
5) Port is reset.
6) One or several NCQ commands are queued.
7) A non-NCQ command is queued, gets stored in ap->deferred_qc.
8) Work is finally run. Yet at this time, there is still NCQ commands in
flight.
The work in 8) really belongs to the non-NCQ command in 2), not to the
non-NCQ command in 7). The reason why the work is executed when it is not
supposed to, is because it was never canceled when ap->deferred_qc was
cleared in 4). Thus, ensure that we always cancel the work after clearing
ap->deferred_qc.
Another potential fix would have been to let ata_scsi_deferred_qc_work() do
nothing if ap->ops->qc_defer() returns non-zero. However, canceling the
work when clearing ap->deferred_qc seems slightly more logical, as we hold
the ap->lock when clearing ap->deferred_qc, so we know that the work cannot
be holding the lock. (The function could be waiting for the lock, but that
is okay since it will do nothing if ap->deferred_qc is not set.)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
ce22aaed011206fed9cbd8c9c2d44718607f31ee , < 0d12453818c35e1ded84633152c6b05002ae48b9
(git)
Affected: 888cd7e40adb2ef4af1b4d3b6e2e83ad409ae8c2 , < 6c5e8f16b5e8e614e829aaf38619bdd79107bb0a (git) Affected: 5d61a38a60e62750526d94663b69b7ac5c7f07a5 , < 58e658763ba2aa9168d8516b98a6314d7461a53e (git) Affected: 0ea84089dbf62a92dc7889c79e6b18fc89260808 , < aac9b27f7c1f2b2cf7f50a9ca633ecbbcaf22af9 (git) Affected: 33abac5b5a5303ba2c66d89e063a806033be07fc (git) Affected: 21e0d7a15a789e99be89231dae25cb6ffc482a7c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/libata-eh.c",
"drivers/ata/libata-scsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d12453818c35e1ded84633152c6b05002ae48b9",
"status": "affected",
"version": "ce22aaed011206fed9cbd8c9c2d44718607f31ee",
"versionType": "git"
},
{
"lessThan": "6c5e8f16b5e8e614e829aaf38619bdd79107bb0a",
"status": "affected",
"version": "888cd7e40adb2ef4af1b4d3b6e2e83ad409ae8c2",
"versionType": "git"
},
{
"lessThan": "58e658763ba2aa9168d8516b98a6314d7461a53e",
"status": "affected",
"version": "5d61a38a60e62750526d94663b69b7ac5c7f07a5",
"versionType": "git"
},
{
"lessThan": "aac9b27f7c1f2b2cf7f50a9ca633ecbbcaf22af9",
"status": "affected",
"version": "0ea84089dbf62a92dc7889c79e6b18fc89260808",
"versionType": "git"
},
{
"status": "affected",
"version": "33abac5b5a5303ba2c66d89e063a806033be07fc",
"versionType": "git"
},
{
"status": "affected",
"version": "21e0d7a15a789e99be89231dae25cb6ffc482a7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/libata-eh.c",
"drivers/ata/libata-scsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0-rc1"
},
{
"lessThan": "7.0-rc1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.18",
"versionStartIncluding": "6.18.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "7.0-rc1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.18.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata: cancel pending work after clearing deferred_qc\n\nSyzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by\nap-\u003eops-\u003eqc_defer() returning non-zero before issuing the deferred qc.\n\nata_scsi_schedule_deferred_qc() is called during each command completion.\nThis function will check if there is a deferred QC, and if\nap-\u003eops-\u003eqc_defer() returns zero, meaning that it is possible to queue the\ndeferred qc at this time (without being deferred), then it will queue the\nwork which will issue the deferred qc.\n\nOnce the work get to run, which can potentially be a very long time after\nthe work was scheduled, there is a WARN_ON() if ap-\u003eops-\u003eqc_defer() returns\nnon-zero.\n\nWhile we hold the ap-\u003elock both when assigning and clearing deferred_qc,\nand the work itself holds the ap-\u003elock, the code currently does not cancel\nthe work after clearing the deferred qc.\n\nThis means that the following scenario can happen:\n1) One or several NCQ commands are queued.\n2) A non-NCQ command is queued, gets stored in ap-\u003edeferred_qc.\n3) Last NCQ command gets completed, work is queued to issue the deferred\n qc.\n4) Timeout or error happens, ap-\u003edeferred_qc is cleared. The queued work is\n currently NOT canceled.\n5) Port is reset.\n6) One or several NCQ commands are queued.\n7) A non-NCQ command is queued, gets stored in ap-\u003edeferred_qc.\n8) Work is finally run. Yet at this time, there is still NCQ commands in\n flight.\n\nThe work in 8) really belongs to the non-NCQ command in 2), not to the\nnon-NCQ command in 7). The reason why the work is executed when it is not\nsupposed to, is because it was never canceled when ap-\u003edeferred_qc was\ncleared in 4). Thus, ensure that we always cancel the work after clearing\nap-\u003edeferred_qc.\n\nAnother potential fix would have been to let ata_scsi_deferred_qc_work() do\nnothing if ap-\u003eops-\u003eqc_defer() returns non-zero. However, canceling the\nwork when clearing ap-\u003edeferred_qc seems slightly more logical, as we hold\nthe ap-\u003elock when clearing ap-\u003edeferred_qc, so we know that the work cannot\nbe holding the lock. (The function could be waiting for the lock, but that\nis okay since it will do nothing if ap-\u003edeferred_qc is not set.)"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:39.514Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d12453818c35e1ded84633152c6b05002ae48b9"
},
{
"url": "https://git.kernel.org/stable/c/6c5e8f16b5e8e614e829aaf38619bdd79107bb0a"
},
{
"url": "https://git.kernel.org/stable/c/58e658763ba2aa9168d8516b98a6314d7461a53e"
},
{
"url": "https://git.kernel.org/stable/c/aac9b27f7c1f2b2cf7f50a9ca633ecbbcaf22af9"
}
],
"title": "ata: libata: cancel pending work after clearing deferred_qc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23355",
"datePublished": "2026-03-25T10:27:39.514Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:39.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23368 (GCVE-0-2026-23368)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and
LED_TRIGGER_PHY are enabled:
[ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc <-- Trying to get lock "triggers_list_lock" via down_write(&triggers_list_lock);
[ 1362.054536] [<80662830>] phy_led_triggers_register+0xd0/0x234
[ 1362.060329] [<8065e200>] phy_attach_direct+0x33c/0x40c
[ 1362.065489] [<80651fc4>] phylink_fwnode_phy_connect+0x15c/0x23c
[ 1362.071480] [<8066ee18>] mtk_open+0x7c/0xba0
[ 1362.075849] [<806d714c>] __dev_open+0x280/0x2b0
[ 1362.080384] [<806d7668>] __dev_change_flags+0x244/0x24c
[ 1362.085598] [<806d7698>] dev_change_flags+0x28/0x78
[ 1362.090528] [<807150e4>] dev_ioctl+0x4c0/0x654 <-- Hold lock "rtnl_mutex" by calling rtnl_lock();
[ 1362.094985] [<80694360>] sock_ioctl+0x2f4/0x4e0
[ 1362.099567] [<802e9c4c>] sys_ioctl+0x32c/0xd8c
[ 1362.104022] [<80014504>] syscall_common+0x34/0x58
Here LED_TRIGGER_PHY is registering LED triggers during phy_attach
while holding RTNL and then taking triggers_list_lock.
[ 1362.191101] [<806c2640>] register_netdevice_notifier+0x60/0x168 <-- Trying to get lock "rtnl_mutex" via rtnl_lock();
[ 1362.197073] [<805504ac>] netdev_trig_activate+0x194/0x1e4
[ 1362.202490] [<8054e28c>] led_trigger_set+0x1d4/0x360 <-- Hold lock "triggers_list_lock" by down_read(&triggers_list_lock);
[ 1362.207511] [<8054eb38>] led_trigger_write+0xd8/0x14c
[ 1362.212566] [<80381d98>] sysfs_kf_bin_write+0x80/0xbc
[ 1362.217688] [<8037fcd8>] kernfs_fop_write_iter+0x17c/0x28c
[ 1362.223174] [<802cbd70>] vfs_write+0x21c/0x3c4
[ 1362.227712] [<802cc0c4>] ksys_write+0x78/0x12c
[ 1362.232164] [<80014504>] syscall_common+0x34/0x58
Here LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes
triggers_list_lock and then RTNL. A classical AB-BA deadlock.
phy_led_triggers_registers() does not require the RTNL, it does not
make any calls into the network stack which require protection. There
is also no requirement the PHY has been attached to a MAC, the
triggers only make use of phydev state. This allows the call to
phy_led_triggers_registers() to be placed elsewhere. PHY probe() and
release() don't hold RTNL, so solving the AB-BA deadlock.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a
(git)
Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < c33523b8fd2d4c504ada18cd93f511f2a8f84217 (git) Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < 241cd64cf2e32b28ead151b1795cd8fef2b6e482 (git) Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < 2764dcb3c35de4410f642afc62cf979727470575 (git) Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757 (git) Affected: 06f502f57d0d7728f9fa0f157ec5e4111ddb98f6 , < c8dbdc6e380e7e96a51706db3e4b7870d8a9402d (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/phy/phy_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a",
"status": "affected",
"version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
"versionType": "git"
},
{
"lessThan": "c33523b8fd2d4c504ada18cd93f511f2a8f84217",
"status": "affected",
"version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
"versionType": "git"
},
{
"lessThan": "241cd64cf2e32b28ead151b1795cd8fef2b6e482",
"status": "affected",
"version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
"versionType": "git"
},
{
"lessThan": "2764dcb3c35de4410f642afc62cf979727470575",
"status": "affected",
"version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
"versionType": "git"
},
{
"lessThan": "cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757",
"status": "affected",
"version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
"versionType": "git"
},
{
"lessThan": "c8dbdc6e380e7e96a51706db3e4b7870d8a9402d",
"status": "affected",
"version": "06f502f57d0d7728f9fa0f157ec5e4111ddb98f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/phy/phy_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: register phy led_triggers during probe to avoid AB-BA deadlock\n\nThere is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and\nLED_TRIGGER_PHY are enabled:\n\n[ 1362.049207] [\u003c8054e4b8\u003e] led_trigger_register+0x5c/0x1fc \u003c-- Trying to get lock \"triggers_list_lock\" via down_write(\u0026triggers_list_lock);\n[ 1362.054536] [\u003c80662830\u003e] phy_led_triggers_register+0xd0/0x234\n[ 1362.060329] [\u003c8065e200\u003e] phy_attach_direct+0x33c/0x40c\n[ 1362.065489] [\u003c80651fc4\u003e] phylink_fwnode_phy_connect+0x15c/0x23c\n[ 1362.071480] [\u003c8066ee18\u003e] mtk_open+0x7c/0xba0\n[ 1362.075849] [\u003c806d714c\u003e] __dev_open+0x280/0x2b0\n[ 1362.080384] [\u003c806d7668\u003e] __dev_change_flags+0x244/0x24c\n[ 1362.085598] [\u003c806d7698\u003e] dev_change_flags+0x28/0x78\n[ 1362.090528] [\u003c807150e4\u003e] dev_ioctl+0x4c0/0x654 \u003c-- Hold lock \"rtnl_mutex\" by calling rtnl_lock();\n[ 1362.094985] [\u003c80694360\u003e] sock_ioctl+0x2f4/0x4e0\n[ 1362.099567] [\u003c802e9c4c\u003e] sys_ioctl+0x32c/0xd8c\n[ 1362.104022] [\u003c80014504\u003e] syscall_common+0x34/0x58\n\nHere LED_TRIGGER_PHY is registering LED triggers during phy_attach\nwhile holding RTNL and then taking triggers_list_lock.\n\n[ 1362.191101] [\u003c806c2640\u003e] register_netdevice_notifier+0x60/0x168 \u003c-- Trying to get lock \"rtnl_mutex\" via rtnl_lock();\n[ 1362.197073] [\u003c805504ac\u003e] netdev_trig_activate+0x194/0x1e4\n[ 1362.202490] [\u003c8054e28c\u003e] led_trigger_set+0x1d4/0x360 \u003c-- Hold lock \"triggers_list_lock\" by down_read(\u0026triggers_list_lock);\n[ 1362.207511] [\u003c8054eb38\u003e] led_trigger_write+0xd8/0x14c\n[ 1362.212566] [\u003c80381d98\u003e] sysfs_kf_bin_write+0x80/0xbc\n[ 1362.217688] [\u003c8037fcd8\u003e] kernfs_fop_write_iter+0x17c/0x28c\n[ 1362.223174] [\u003c802cbd70\u003e] vfs_write+0x21c/0x3c4\n[ 1362.227712] [\u003c802cc0c4\u003e] ksys_write+0x78/0x12c\n[ 1362.232164] [\u003c80014504\u003e] syscall_common+0x34/0x58\n\nHere LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes\ntriggers_list_lock and then RTNL. A classical AB-BA deadlock.\n\nphy_led_triggers_registers() does not require the RTNL, it does not\nmake any calls into the network stack which require protection. There\nis also no requirement the PHY has been attached to a MAC, the\ntriggers only make use of phydev state. This allows the call to\nphy_led_triggers_registers() to be placed elsewhere. PHY probe() and\nrelease() don\u0027t hold RTNL, so solving the AB-BA deadlock."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:49.889Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c6ffc2d2338d325e1edd0c702e3ee623aa5fdc6a"
},
{
"url": "https://git.kernel.org/stable/c/c33523b8fd2d4c504ada18cd93f511f2a8f84217"
},
{
"url": "https://git.kernel.org/stable/c/241cd64cf2e32b28ead151b1795cd8fef2b6e482"
},
{
"url": "https://git.kernel.org/stable/c/2764dcb3c35de4410f642afc62cf979727470575"
},
{
"url": "https://git.kernel.org/stable/c/cde2d0b5ab5d03b5b6f17d4f654d8b30ccf36757"
},
{
"url": "https://git.kernel.org/stable/c/c8dbdc6e380e7e96a51706db3e4b7870d8a9402d"
}
],
"title": "net: phy: register phy led_triggers during probe to avoid AB-BA deadlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23368",
"datePublished": "2026-03-25T10:27:49.889Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:49.889Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23306 (GCVE-0-2026-23306)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
scsi: pm8001: Fix use-after-free in pm8001_queue_command()
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Fix use-after-free in pm8001_queue_command()
Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors
pm8001_queue_command(), however it introduces a potential cause of a double
free scenario when it changes the function to return -ENODEV in case of phy
down/device gone state.
In this path, pm8001_queue_command() updates task status and calls
task_done to indicate to upper layer that the task has been handled.
However, this also frees the underlying SAS task. A -ENODEV is then
returned to the caller. When libsas sas_ata_qc_issue() receives this error
value, it assumes the task wasn't handled/queued by LLDD and proceeds to
clean up and free the task again, resulting in a double free.
Since pm8001_queue_command() handles the SAS task in this case, it should
return 0 to the caller indicating that the task has been handled.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
e29c47fe8946cc732b0e0d393b65b13c84bb69d0 , < ebbb852ffbc952b95ddb7e3872b67b3e74c6da47
(git)
Affected: e29c47fe8946cc732b0e0d393b65b13c84bb69d0 , < 8b00427317ba7b7ec91252b034009f638d0f311b (git) Affected: e29c47fe8946cc732b0e0d393b65b13c84bb69d0 , < c5dc39f8ae055520fd778b7fb0423f11586f15c4 (git) Affected: e29c47fe8946cc732b0e0d393b65b13c84bb69d0 , < 824a7672e3540962d5c77d4c6666254d7aa6f0b3 (git) Affected: e29c47fe8946cc732b0e0d393b65b13c84bb69d0 , < 227ff4af00abc40b95123cc27ee8079069dcd8d7 (git) Affected: e29c47fe8946cc732b0e0d393b65b13c84bb69d0 , < 38353c26db28efd984f51d426eac2396d299cca7 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/pm8001/pm8001_sas.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ebbb852ffbc952b95ddb7e3872b67b3e74c6da47",
"status": "affected",
"version": "e29c47fe8946cc732b0e0d393b65b13c84bb69d0",
"versionType": "git"
},
{
"lessThan": "8b00427317ba7b7ec91252b034009f638d0f311b",
"status": "affected",
"version": "e29c47fe8946cc732b0e0d393b65b13c84bb69d0",
"versionType": "git"
},
{
"lessThan": "c5dc39f8ae055520fd778b7fb0423f11586f15c4",
"status": "affected",
"version": "e29c47fe8946cc732b0e0d393b65b13c84bb69d0",
"versionType": "git"
},
{
"lessThan": "824a7672e3540962d5c77d4c6666254d7aa6f0b3",
"status": "affected",
"version": "e29c47fe8946cc732b0e0d393b65b13c84bb69d0",
"versionType": "git"
},
{
"lessThan": "227ff4af00abc40b95123cc27ee8079069dcd8d7",
"status": "affected",
"version": "e29c47fe8946cc732b0e0d393b65b13c84bb69d0",
"versionType": "git"
},
{
"lessThan": "38353c26db28efd984f51d426eac2396d299cca7",
"status": "affected",
"version": "e29c47fe8946cc732b0e0d393b65b13c84bb69d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/pm8001/pm8001_sas.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free in pm8001_queue_command()\n\nCommit e29c47fe8946 (\"scsi: pm8001: Simplify pm8001_task_exec()\") refactors\npm8001_queue_command(), however it introduces a potential cause of a double\nfree scenario when it changes the function to return -ENODEV in case of phy\ndown/device gone state.\n\nIn this path, pm8001_queue_command() updates task status and calls\ntask_done to indicate to upper layer that the task has been handled.\nHowever, this also frees the underlying SAS task. A -ENODEV is then\nreturned to the caller. When libsas sas_ata_qc_issue() receives this error\nvalue, it assumes the task wasn\u0027t handled/queued by LLDD and proceeds to\nclean up and free the task again, resulting in a double free.\n\nSince pm8001_queue_command() handles the SAS task in this case, it should\nreturn 0 to the caller indicating that the task has been handled."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:01.719Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ebbb852ffbc952b95ddb7e3872b67b3e74c6da47"
},
{
"url": "https://git.kernel.org/stable/c/8b00427317ba7b7ec91252b034009f638d0f311b"
},
{
"url": "https://git.kernel.org/stable/c/c5dc39f8ae055520fd778b7fb0423f11586f15c4"
},
{
"url": "https://git.kernel.org/stable/c/824a7672e3540962d5c77d4c6666254d7aa6f0b3"
},
{
"url": "https://git.kernel.org/stable/c/227ff4af00abc40b95123cc27ee8079069dcd8d7"
},
{
"url": "https://git.kernel.org/stable/c/38353c26db28efd984f51d426eac2396d299cca7"
}
],
"title": "scsi: pm8001: Fix use-after-free in pm8001_queue_command()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23306",
"datePublished": "2026-03-25T10:27:01.719Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:27:01.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23376 (GCVE-0-2026-23376)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
nvmet-fcloop: Check remoteport port_state before calling done callback
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-fcloop: Check remoteport port_state before calling done callback
In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when
remoteport->port_state is FC_OBJSTATE_ONLINE. Otherwise, the
nvme_fc_xmt_ls_rsp's LLDD call to lport->ops->xmt_ls_rsp is expected to
fail and the nvme-fc transport layer itself will directly call
nvme_fc_xmt_ls_rsp_free instead of relying on LLDD's done callback to free
the lsrsp resources.
Update the fcloop_t2h_xmt_ls_rsp routine to check remoteport->port_state.
If online, then lsrsp->done callback will free the lsrsp. Else, return
-ENODEV to signal the nvme-fc transport to handle freeing lsrsp.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
10c165af35d225eb033f4edc7fcc699a8d2d533d , < f30b95159a53e72529a9ca1667f11cd1970240a7
(git)
Affected: 10c165af35d225eb033f4edc7fcc699a8d2d533d , < 31d3817bcd9e192b30abe3cf4b68f69d48864dd2 (git) Affected: 10c165af35d225eb033f4edc7fcc699a8d2d533d , < dd677d0598387ea623820ab2bd0e029c377445a3 (git) Affected: 2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fcloop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f30b95159a53e72529a9ca1667f11cd1970240a7",
"status": "affected",
"version": "10c165af35d225eb033f4edc7fcc699a8d2d533d",
"versionType": "git"
},
{
"lessThan": "31d3817bcd9e192b30abe3cf4b68f69d48864dd2",
"status": "affected",
"version": "10c165af35d225eb033f4edc7fcc699a8d2d533d",
"versionType": "git"
},
{
"lessThan": "dd677d0598387ea623820ab2bd0e029c377445a3",
"status": "affected",
"version": "10c165af35d225eb033f4edc7fcc699a8d2d533d",
"versionType": "git"
},
{
"status": "affected",
"version": "2cf857075bcc8e83c4aa5fe7d8f1efd6af51e04e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fcloop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fcloop: Check remoteport port_state before calling done callback\n\nIn nvme_fc_handle_ls_rqst_work, the lsrsp-\u003edone callback is only set when\nremoteport-\u003eport_state is FC_OBJSTATE_ONLINE. Otherwise, the\nnvme_fc_xmt_ls_rsp\u0027s LLDD call to lport-\u003eops-\u003exmt_ls_rsp is expected to\nfail and the nvme-fc transport layer itself will directly call\nnvme_fc_xmt_ls_rsp_free instead of relying on LLDD\u0027s done callback to free\nthe lsrsp resources.\n\nUpdate the fcloop_t2h_xmt_ls_rsp routine to check remoteport-\u003eport_state.\nIf online, then lsrsp-\u003edone callback will free the lsrsp. Else, return\n-ENODEV to signal the nvme-fc transport to handle freeing lsrsp."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:56.458Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f30b95159a53e72529a9ca1667f11cd1970240a7"
},
{
"url": "https://git.kernel.org/stable/c/31d3817bcd9e192b30abe3cf4b68f69d48864dd2"
},
{
"url": "https://git.kernel.org/stable/c/dd677d0598387ea623820ab2bd0e029c377445a3"
}
],
"title": "nvmet-fcloop: Check remoteport port_state before calling done callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23376",
"datePublished": "2026-03-25T10:27:56.458Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:56.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23385 (GCVE-0-2026-23385)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
netfilter: nf_tables: clone set on flush only
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: clone set on flush only
Syzbot with fault injection triggered a failing memory allocation with
GFP_KERNEL which results in a WARN splat:
iter.err
WARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992
Modules linked in:
CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845
Code: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 <0f> 0b 90 43
+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9
RSP: 0018:ffffc900045af780 EFLAGS: 00010293
RAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40
RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000
RBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0
R13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920
FS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0
Call Trace:
<TASK>
__nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115
nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761
__sock_release net/socket.c:662 [inline]
sock_close+0xc3/0x240 net/socket.c:1455
Restrict set clone to the flush set command in the preparation phase.
Add NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree
and pipapo backends to only clone the set when this iteration type is
used.
As for the existing NFT_ITER_UPDATE type, update the pipapo backend to
use the existing set clone if available, otherwise use the existing set
representation. After this update, there is no need to clone a set that
is being deleted, this includes bound anonymous set.
An alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone
interface and call it from the flush set path.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc , < 9154945a6394029822bd08c24cef5a3f86d0424a
(git)
Affected: 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc , < b7f67282ca2be14b727dd698b50e10cf5d8c66f9 (git) Affected: 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc , < fb7fb4016300ac622c964069e286dc83166a5d52 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_hash.c",
"net/netfilter/nft_set_pipapo.c",
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9154945a6394029822bd08c24cef5a3f86d0424a",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
},
{
"lessThan": "b7f67282ca2be14b727dd698b50e10cf5d8c66f9",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
},
{
"lessThan": "fb7fb4016300ac622c964069e286dc83166a5d52",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_hash.c",
"net/netfilter/nft_set_pipapo.c",
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: clone set on flush only\n\nSyzbot with fault injection triggered a failing memory allocation with\nGFP_KERNEL which results in a WARN splat:\n\niter.err\nWARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992\nModules linked in:\nCPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026\nRIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845\nCode: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 \u003c0f\u003e 0b 90 43\n+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9\nRSP: 0018:ffffc900045af780 EFLAGS: 00010293\nRAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40\nRDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000\nRBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff\nR10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0\nR13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920\nFS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115\n nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187\n notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85\n blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380\n netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761\n __sock_release net/socket.c:662 [inline]\n sock_close+0xc3/0x240 net/socket.c:1455\n\nRestrict set clone to the flush set command in the preparation phase.\nAdd NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree\nand pipapo backends to only clone the set when this iteration type is\nused.\n\nAs for the existing NFT_ITER_UPDATE type, update the pipapo backend to\nuse the existing set clone if available, otherwise use the existing set\nrepresentation. After this update, there is no need to clone a set that\nis being deleted, this includes bound anonymous set.\n\nAn alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone\ninterface and call it from the flush set path."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:03.460Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9154945a6394029822bd08c24cef5a3f86d0424a"
},
{
"url": "https://git.kernel.org/stable/c/b7f67282ca2be14b727dd698b50e10cf5d8c66f9"
},
{
"url": "https://git.kernel.org/stable/c/fb7fb4016300ac622c964069e286dc83166a5d52"
}
],
"title": "netfilter: nf_tables: clone set on flush only",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23385",
"datePublished": "2026-03-25T10:28:03.460Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T10:28:03.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23313 (GCVE-0-2026-23313)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
i40e: Fix preempt count leak in napi poll tracepoint
Summary
In the Linux kernel, the following vulnerability has been resolved:
i40e: Fix preempt count leak in napi poll tracepoint
Using get_cpu() in the tracepoint assignment causes an obvious preempt
count leak because nothing invokes put_cpu() to undo it:
softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?
This clearly has seen a lot of testing in the last 3+ years...
Use smp_processor_id() instead.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
6d4d584a7ea8fc8d2be77545cb503118c193738a , < b7e91827e1cf89cd34ad11dc8f8c010b70ab786e
(git)
Affected: 6d4d584a7ea8fc8d2be77545cb503118c193738a , < 9e0f091821571f0da387462803ee42f0bb157582 (git) Affected: 6d4d584a7ea8fc8d2be77545cb503118c193738a , < dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f (git) Affected: 6d4d584a7ea8fc8d2be77545cb503118c193738a , < 4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/i40e/i40e_trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7e91827e1cf89cd34ad11dc8f8c010b70ab786e",
"status": "affected",
"version": "6d4d584a7ea8fc8d2be77545cb503118c193738a",
"versionType": "git"
},
{
"lessThan": "9e0f091821571f0da387462803ee42f0bb157582",
"status": "affected",
"version": "6d4d584a7ea8fc8d2be77545cb503118c193738a",
"versionType": "git"
},
{
"lessThan": "dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f",
"status": "affected",
"version": "6d4d584a7ea8fc8d2be77545cb503118c193738a",
"versionType": "git"
},
{
"lessThan": "4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9",
"status": "affected",
"version": "6d4d584a7ea8fc8d2be77545cb503118c193738a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/i40e/i40e_trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix preempt count leak in napi poll tracepoint\n\nUsing get_cpu() in the tracepoint assignment causes an obvious preempt\ncount leak because nothing invokes put_cpu() to undo it:\n\n softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?\n\nThis clearly has seen a lot of testing in the last 3+ years...\n\nUse smp_processor_id() instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:08.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7e91827e1cf89cd34ad11dc8f8c010b70ab786e"
},
{
"url": "https://git.kernel.org/stable/c/9e0f091821571f0da387462803ee42f0bb157582"
},
{
"url": "https://git.kernel.org/stable/c/dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f"
},
{
"url": "https://git.kernel.org/stable/c/4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9"
}
],
"title": "i40e: Fix preempt count leak in napi poll tracepoint",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23313",
"datePublished": "2026-03-25T10:27:08.686Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:08.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23340 (GCVE-0-2026-23340)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
When shrinking the number of real tx queues,
netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush
qdiscs for queues which will no longer be used.
qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with
qdisc_lock(). However, for lockless qdiscs, the dequeue path is
serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so
qdisc_reset() can run concurrently with __qdisc_run() and free skbs
while they are still being dequeued, leading to UAF.
This can easily be reproduced on e.g. virtio-net by imposing heavy
traffic while frequently changing the number of queue pairs:
iperf3 -ub0 -c $peer -t 0 &
while :; do
ethtool -L eth0 combined 1
ethtool -L eth0 combined 2
done
With KASAN enabled, this leads to reports like:
BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760
...
Call Trace:
<TASK>
...
__qdisc_run+0x133f/0x1760
__dev_queue_xmit+0x248f/0x3550
ip_finish_output2+0xa42/0x2110
ip_output+0x1a7/0x410
ip_send_skb+0x2e6/0x480
udp_send_skb+0xb0a/0x1590
udp_sendmsg+0x13c9/0x1fc0
...
</TASK>
Allocated by task 1270 on cpu 5 at 44.558414s:
...
alloc_skb_with_frags+0x84/0x7c0
sock_alloc_send_pskb+0x69a/0x830
__ip_append_data+0x1b86/0x48c0
ip_make_skb+0x1e8/0x2b0
udp_sendmsg+0x13a6/0x1fc0
...
Freed by task 1306 on cpu 3 at 44.558445s:
...
kmem_cache_free+0x117/0x5e0
pfifo_fast_reset+0x14d/0x580
qdisc_reset+0x9e/0x5f0
netif_set_real_num_tx_queues+0x303/0x840
virtnet_set_channels+0x1bf/0x260 [virtio_net]
ethnl_set_channels+0x684/0xae0
ethnl_default_set_doit+0x31a/0x890
...
Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by
taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the
serialization model already used by dev_reset_queue().
Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state
reflects an empty queue, avoiding needless re-scheduling.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 , < 7594467c49bfc2f4644dee0415ac2290db11fa0d
(git)
Affected: 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 , < dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750 (git) Affected: 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 , < 5bc4e69306ed7ae02232eb4c0b23ed621a26d504 (git) Affected: 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 , < 8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb (git) Affected: 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 , < c69df4e0524f8de8e176ba389acd83e85f5f49d0 (git) Affected: 6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7 , < 7f083faf59d14c04e01ec05a7507f036c965acf8 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sch_generic.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7594467c49bfc2f4644dee0415ac2290db11fa0d",
"status": "affected",
"version": "6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7",
"versionType": "git"
},
{
"lessThan": "dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750",
"status": "affected",
"version": "6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7",
"versionType": "git"
},
{
"lessThan": "5bc4e69306ed7ae02232eb4c0b23ed621a26d504",
"status": "affected",
"version": "6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7",
"versionType": "git"
},
{
"lessThan": "8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb",
"status": "affected",
"version": "6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7",
"versionType": "git"
},
{
"lessThan": "c69df4e0524f8de8e176ba389acd83e85f5f49d0",
"status": "affected",
"version": "6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7",
"versionType": "git"
},
{
"lessThan": "7f083faf59d14c04e01ec05a7507f036c965acf8",
"status": "affected",
"version": "6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sch_generic.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u003eseqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n iperf3 -ub0 -c $peer -t 0 \u0026\n while :; do\n ethtool -L eth0 combined 1\n ethtool -L eth0 combined 2\n done\n\nWith KASAN enabled, this leads to reports like:\n\n BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n ...\n Call Trace:\n \u003cTASK\u003e\n ...\n __qdisc_run+0x133f/0x1760\n __dev_queue_xmit+0x248f/0x3550\n ip_finish_output2+0xa42/0x2110\n ip_output+0x1a7/0x410\n ip_send_skb+0x2e6/0x480\n udp_send_skb+0xb0a/0x1590\n udp_sendmsg+0x13c9/0x1fc0\n ...\n \u003c/TASK\u003e\n\n Allocated by task 1270 on cpu 5 at 44.558414s:\n ...\n alloc_skb_with_frags+0x84/0x7c0\n sock_alloc_send_pskb+0x69a/0x830\n __ip_append_data+0x1b86/0x48c0\n ip_make_skb+0x1e8/0x2b0\n udp_sendmsg+0x13a6/0x1fc0\n ...\n\n Freed by task 1306 on cpu 3 at 44.558445s:\n ...\n kmem_cache_free+0x117/0x5e0\n pfifo_fast_reset+0x14d/0x580\n qdisc_reset+0x9e/0x5f0\n netif_set_real_num_tx_queues+0x303/0x840\n virtnet_set_channels+0x1bf/0x260 [virtio_net]\n ethnl_set_channels+0x684/0xae0\n ethnl_default_set_doit+0x31a/0x890\n ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u003eseqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:28.728Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7594467c49bfc2f4644dee0415ac2290db11fa0d"
},
{
"url": "https://git.kernel.org/stable/c/dbd58b0730aa06ab6ad26079cf9a5b6b58e7e750"
},
{
"url": "https://git.kernel.org/stable/c/5bc4e69306ed7ae02232eb4c0b23ed621a26d504"
},
{
"url": "https://git.kernel.org/stable/c/8314944cc3bdeaa5a73e6f8a8cf0d94822e625cb"
},
{
"url": "https://git.kernel.org/stable/c/c69df4e0524f8de8e176ba389acd83e85f5f49d0"
},
{
"url": "https://git.kernel.org/stable/c/7f083faf59d14c04e01ec05a7507f036c965acf8"
}
],
"title": "net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23340",
"datePublished": "2026-03-25T10:27:28.728Z",
"dateReserved": "2026-01-13T15:37:45.998Z",
"dateUpdated": "2026-03-25T10:27:28.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23332 (GCVE-0-2026-23332)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
cpufreq: intel_pstate: Fix crash during turbo disable
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: intel_pstate: Fix crash during turbo disable
When the system is booted with kernel command line argument "nosmt" or
"maxcpus" to limit the number of CPUs, disabling turbo via:
echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo
results in a crash:
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
...
RIP: 0010:store_no_turbo+0x100/0x1f0
...
This occurs because for_each_possible_cpu() returns CPUs even if they
are not online. For those CPUs, all_cpu_data[] will be NULL. Since
commit 973207ae3d7c ("cpufreq: intel_pstate: Rearrange max frequency
updates handling code"), all_cpu_data[] is dereferenced even for CPUs
which are not online, causing the NULL pointer dereference.
To fix that, pass CPU number to intel_pstate_update_max_freq() and use
all_cpu_data[] for those CPUs for which there is a valid cpufreq policy.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
973207ae3d7c3c92df4a382df5d7bd695deaa904 , < a1850e2aef4d15405e7ff53fd51c4b3124d46182
(git)
Affected: 973207ae3d7c3c92df4a382df5d7bd695deaa904 , < d20d48916ce8531b157c2edeba76d69af2974270 (git) Affected: 973207ae3d7c3c92df4a382df5d7bd695deaa904 , < 6b050482ec40569429d963ac52afa878691b04c9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/intel_pstate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1850e2aef4d15405e7ff53fd51c4b3124d46182",
"status": "affected",
"version": "973207ae3d7c3c92df4a382df5d7bd695deaa904",
"versionType": "git"
},
{
"lessThan": "d20d48916ce8531b157c2edeba76d69af2974270",
"status": "affected",
"version": "973207ae3d7c3c92df4a382df5d7bd695deaa904",
"versionType": "git"
},
{
"lessThan": "6b050482ec40569429d963ac52afa878691b04c9",
"status": "affected",
"version": "973207ae3d7c3c92df4a382df5d7bd695deaa904",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/intel_pstate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: intel_pstate: Fix crash during turbo disable\n\nWhen the system is booted with kernel command line argument \"nosmt\" or\n\"maxcpus\" to limit the number of CPUs, disabling turbo via:\n\n echo 1 \u003e /sys/devices/system/cpu/intel_pstate/no_turbo\n\nresults in a crash:\n\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP PTI\n ...\n RIP: 0010:store_no_turbo+0x100/0x1f0\n ...\n\nThis occurs because for_each_possible_cpu() returns CPUs even if they\nare not online. For those CPUs, all_cpu_data[] will be NULL. Since\ncommit 973207ae3d7c (\"cpufreq: intel_pstate: Rearrange max frequency\nupdates handling code\"), all_cpu_data[] is dereferenced even for CPUs\nwhich are not online, causing the NULL pointer dereference.\n\nTo fix that, pass CPU number to intel_pstate_update_max_freq() and use\nall_cpu_data[] for those CPUs for which there is a valid cpufreq policy."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:23.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1850e2aef4d15405e7ff53fd51c4b3124d46182"
},
{
"url": "https://git.kernel.org/stable/c/d20d48916ce8531b157c2edeba76d69af2974270"
},
{
"url": "https://git.kernel.org/stable/c/6b050482ec40569429d963ac52afa878691b04c9"
}
],
"title": "cpufreq: intel_pstate: Fix crash during turbo disable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23332",
"datePublished": "2026-03-25T10:27:23.193Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:23.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23350 (GCVE-0-2026-23350)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
drm/xe/queue: Call fini on exec queue creation fail
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/queue: Call fini on exec queue creation fail
Every call to queue init should have a corresponding fini call.
Skipping this would mean skipping removal of the queue from GuC list
(which is part of guc_id allocation). A damaged queue stored in
exec_queue_lookup list would lead to invalid memory reference,
sooner or later.
Call fini to free guc_id. This must be done before any internal
LRCs are freed.
Since the finalization with this extra call became very similar to
__xe_exec_queue_fini(), reuse that. To make this reuse possible,
alter xe_lrc_put() so it can survive NULL parameters, like other
similar functions.
v2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.
(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec_queue.c",
"drivers/gpu/drm/xe/xe_lrc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fae65b8a4449ae556990efcde8d74bec4adc5925",
"status": "affected",
"version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952",
"versionType": "git"
},
{
"lessThan": "99f9b5343cae80eb0dfe050baf6c86d722b3ba2e",
"status": "affected",
"version": "3c1fa4aa60b146d1fa73b2b87064303f8e4b7952",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec_queue.c",
"drivers/gpu/drm/xe/xe_lrc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/queue: Call fini on exec queue creation fail\n\nEvery call to queue init should have a corresponding fini call.\nSkipping this would mean skipping removal of the queue from GuC list\n(which is part of guc_id allocation). A damaged queue stored in\nexec_queue_lookup list would lead to invalid memory reference,\nsooner or later.\n\nCall fini to free guc_id. This must be done before any internal\nLRCs are freed.\n\nSince the finalization with this extra call became very similar to\n__xe_exec_queue_fini(), reuse that. To make this reuse possible,\nalter xe_lrc_put() so it can survive NULL parameters, like other\nsimilar functions.\n\nv2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.\n\n(cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079)"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:36.182Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fae65b8a4449ae556990efcde8d74bec4adc5925"
},
{
"url": "https://git.kernel.org/stable/c/99f9b5343cae80eb0dfe050baf6c86d722b3ba2e"
}
],
"title": "drm/xe/queue: Call fini on exec queue creation fail",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23350",
"datePublished": "2026-03-25T10:27:36.182Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:36.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23335 (GCVE-0-2026-23335)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
struct irdma_create_ah_resp { // 8 bytes, no padding
__u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx)
__u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK
};
rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().
The reserved members of the structure were not zeroed.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 14b47c07c69930254f549a17ee245c80a65b1609
(git)
Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 1b1fac4c7a3ab7f52e9cfb91e5c91216646ca4d8 (git) Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 2fd37450d271d74b3847baed284f9cfdf198c6f8 (git) Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < cfe962216c164fe2b1c1fb6ac925a7413f5abc84 (git) Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < c9bd0007c4bdb7806bbd323287e50f9cf467c51a (git) Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 74586c6da9ea222a61c98394f2fc0a604748438c (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14b47c07c69930254f549a17ee245c80a65b1609",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "1b1fac4c7a3ab7f52e9cfb91e5c91216646ca4d8",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "2fd37450d271d74b3847baed284f9cfdf198c6f8",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "cfe962216c164fe2b1c1fb6ac925a7413f5abc84",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "c9bd0007c4bdb7806bbd323287e50f9cf467c51a",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "74586c6da9ea222a61c98394f2fc0a604748438c",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()\n\nstruct irdma_create_ah_resp { // 8 bytes, no padding\n __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah-\u003esc_ah.ah_info.ah_idx)\n __u8 rsvd[4]; // offset 4 - NEVER SET \u003c- LEAK\n};\n\nrsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().\n\nThe reserved members of the structure were not zeroed."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:25.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14b47c07c69930254f549a17ee245c80a65b1609"
},
{
"url": "https://git.kernel.org/stable/c/1b1fac4c7a3ab7f52e9cfb91e5c91216646ca4d8"
},
{
"url": "https://git.kernel.org/stable/c/2fd37450d271d74b3847baed284f9cfdf198c6f8"
},
{
"url": "https://git.kernel.org/stable/c/cfe962216c164fe2b1c1fb6ac925a7413f5abc84"
},
{
"url": "https://git.kernel.org/stable/c/c9bd0007c4bdb7806bbd323287e50f9cf467c51a"
},
{
"url": "https://git.kernel.org/stable/c/74586c6da9ea222a61c98394f2fc0a604748438c"
}
],
"title": "RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23335",
"datePublished": "2026-03-25T10:27:25.418Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:25.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23384 (GCVE-0-2026-23384)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
struct ionic_cq_resp resp {
__u32 cqid[2]; // offset 0 - PARTIALLY SET (see below)
__u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask)
__u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK
};
rsvd[7]: 7 bytes of stack memory leaked unconditionally.
cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices
where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but
udma_count could be 1, meaning cqid[1] might never be written via
ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4
bytes) is also leaked. So potentially 11 bytes leaked.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
e8521822c733c6deab0f339843cd37cd62c12795 , < a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e
(git)
Affected: e8521822c733c6deab0f339843cd37cd62c12795 , < 547d0b07ad73915b323bc21f85c5d3252bebbbcf (git) Affected: e8521822c733c6deab0f339843cd37cd62c12795 , < faa72102b178c7ae6c6afea23879e7c84fc59b4e (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/ionic/ionic_controlpath.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e",
"status": "affected",
"version": "e8521822c733c6deab0f339843cd37cd62c12795",
"versionType": "git"
},
{
"lessThan": "547d0b07ad73915b323bc21f85c5d3252bebbbcf",
"status": "affected",
"version": "e8521822c733c6deab0f339843cd37cd62c12795",
"versionType": "git"
},
{
"lessThan": "faa72102b178c7ae6c6afea23879e7c84fc59b4e",
"status": "affected",
"version": "e8521822c733c6deab0f339843cd37cd62c12795",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/ionic/ionic_controlpath.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ionic: Fix kernel stack leak in ionic_create_cq()\n\nstruct ionic_cq_resp resp {\n __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below)\n __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq-\u003eudma_mask)\n __u8 rsvd[7]; // offset 9 - NEVER SET \u003c- LEAK\n};\n\nrsvd[7]: 7 bytes of stack memory leaked unconditionally.\n\ncqid[2]: The loop at line 1256 iterates over udma_idx but skips indices\nwhere !(vcq-\u003eudma_mask \u0026 BIT(udma_idx)). The array has 2 entries but\nudma_count could be 1, meaning cqid[1] might never be written via\nionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4\nbytes) is also leaked. So potentially 11 bytes leaked."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:02.818Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e"
},
{
"url": "https://git.kernel.org/stable/c/547d0b07ad73915b323bc21f85c5d3252bebbbcf"
},
{
"url": "https://git.kernel.org/stable/c/faa72102b178c7ae6c6afea23879e7c84fc59b4e"
}
],
"title": "RDMA/ionic: Fix kernel stack leak in ionic_create_cq()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23384",
"datePublished": "2026-03-25T10:28:02.818Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T10:28:02.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23321 (GCVE-0-2026-23321)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
mptcp: pm: in-kernel: always mark signal+subflow endp as used
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: in-kernel: always mark signal+subflow endp as used
Syzkaller managed to find a combination of actions that was generating
this warning:
msk->pm.local_addr_used == 0
WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961
WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961
WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961
Modules linked in:
CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full)
Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014
RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline]
RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline]
RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210
Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 <0f> 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a
RSP: 0018:ffffc90001663880 EFLAGS: 00010293
RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880158b22d0 R08: 0000000000010425 R09: ffffffffffffffff
R10: ffffffff82de18ba R11: 0000000000000000 R12: ffff88800641a640
R13: ffff8880158b1880 R14: ffff88801ec3c900 R15: ffff88800641a650
FS: 00005555722c3500(0000) GS:ffff8880f909d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f66346e0f60 CR3: 000000001607c000 CR4: 0000000000350ef0
Call Trace:
<TASK>
genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x4aa/0x5b0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0xc9/0xf0 net/socket.c:742
____sys_sendmsg+0x272/0x3b0 net/socket.c:2592
___sys_sendmsg+0x2de/0x320 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x143/0x440 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f66346f826d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc83d8bdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f6634985fa0 RCX: 00007f66346f826d
RDX: 00000000040000b0 RSI: 0000200000000740 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6634985fa8
R13: 00007f6634985fac R14: 0000000000000000 R15: 0000000000001770
</TASK>
The actions that caused that seem to be:
- Set the MPTCP subflows limit to 0
- Create an MPTCP endpoint with both the 'signal' and 'subflow' flags
- Create a new MPTCP connection from a different address: an ADD_ADDR
linked to the MPTCP endpoint will be sent ('signal' flag), but no
subflows is initiated ('subflow' flag)
- Remove the MPTCP endpoint
---truncated---
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d93cf38fad9f66397093432b8917971a92ee0146 , < c5c877e140e5f46023a74a51e577ce5edd0a4be7
(git)
Affected: 64815ba15880ce5f99df075fa4104fef170ac7e5 , < 05799c2f1ca5eb13d65764dda688d02021b65e06 (git) Affected: 85df533a787bf07bf4367ce2a02b822ff1fba1a3 , < 67f34ab318807989b57dfdb0f79e2d4e57018290 (git) Affected: 85df533a787bf07bf4367ce2a02b822ff1fba1a3 , < a64aa7db39392add5be09dffaedbf1f0ce5554df (git) Affected: 85df533a787bf07bf4367ce2a02b822ff1fba1a3 , < 198824ccfa64ffebd918bf99c939bd8170a4a4d8 (git) Affected: 85df533a787bf07bf4367ce2a02b822ff1fba1a3 , < 579a752464a64cb5f9139102f0e6b90a1f595ceb (git) Affected: 0f21cc29bc13e86512621727a4388c8a7ad2716b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/pm_kernel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5c877e140e5f46023a74a51e577ce5edd0a4be7",
"status": "affected",
"version": "d93cf38fad9f66397093432b8917971a92ee0146",
"versionType": "git"
},
{
"lessThan": "05799c2f1ca5eb13d65764dda688d02021b65e06",
"status": "affected",
"version": "64815ba15880ce5f99df075fa4104fef170ac7e5",
"versionType": "git"
},
{
"lessThan": "67f34ab318807989b57dfdb0f79e2d4e57018290",
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"versionType": "git"
},
{
"lessThan": "a64aa7db39392add5be09dffaedbf1f0ce5554df",
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"versionType": "git"
},
{
"lessThan": "198824ccfa64ffebd918bf99c939bd8170a4a4d8",
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"versionType": "git"
},
{
"lessThan": "579a752464a64cb5f9139102f0e6b90a1f595ceb",
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"versionType": "git"
},
{
"status": "affected",
"version": "0f21cc29bc13e86512621727a4388c8a7ad2716b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/pm_kernel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.106",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: in-kernel: always mark signal+subflow endp as used\n\nSyzkaller managed to find a combination of actions that was generating\nthis warning:\n\n msk-\u003epm.local_addr_used == 0\n WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961\n WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961\n WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961\n Modules linked in:\n CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full)\n Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014\n RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline]\n RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline]\n RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210\n Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 \u003c0f\u003e 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a\n RSP: 0018:ffffc90001663880 EFLAGS: 00010293\n RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffff8880158b22d0 R08: 0000000000010425 R09: ffffffffffffffff\n R10: ffffffff82de18ba R11: 0000000000000000 R12: ffff88800641a640\n R13: ffff8880158b1880 R14: ffff88801ec3c900 R15: ffff88800641a650\n FS: 00005555722c3500(0000) GS:ffff8880f909d000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f66346e0f60 CR3: 000000001607c000 CR4: 0000000000350ef0\n Call Trace:\n \u003cTASK\u003e\n genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x4aa/0x5b0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xc9/0xf0 net/socket.c:742\n ____sys_sendmsg+0x272/0x3b0 net/socket.c:2592\n ___sys_sendmsg+0x2de/0x320 net/socket.c:2646\n __sys_sendmsg net/socket.c:2678 [inline]\n __do_sys_sendmsg net/socket.c:2683 [inline]\n __se_sys_sendmsg net/socket.c:2681 [inline]\n __x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2681\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x143/0x440 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f66346f826d\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007ffc83d8bdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 00007f6634985fa0 RCX: 00007f66346f826d\n RDX: 00000000040000b0 RSI: 0000200000000740 RDI: 0000000000000007\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6634985fa8\n R13: 00007f6634985fac R14: 0000000000000000 R15: 0000000000001770\n \u003c/TASK\u003e\n\nThe actions that caused that seem to be:\n\n - Set the MPTCP subflows limit to 0\n - Create an MPTCP endpoint with both the \u0027signal\u0027 and \u0027subflow\u0027 flags\n - Create a new MPTCP connection from a different address: an ADD_ADDR\n linked to the MPTCP endpoint will be sent (\u0027signal\u0027 flag), but no\n subflows is initiated (\u0027subflow\u0027 flag)\n - Remove the MPTCP endpoint\n\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:15.125Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5c877e140e5f46023a74a51e577ce5edd0a4be7"
},
{
"url": "https://git.kernel.org/stable/c/05799c2f1ca5eb13d65764dda688d02021b65e06"
},
{
"url": "https://git.kernel.org/stable/c/67f34ab318807989b57dfdb0f79e2d4e57018290"
},
{
"url": "https://git.kernel.org/stable/c/a64aa7db39392add5be09dffaedbf1f0ce5554df"
},
{
"url": "https://git.kernel.org/stable/c/198824ccfa64ffebd918bf99c939bd8170a4a4d8"
},
{
"url": "https://git.kernel.org/stable/c/579a752464a64cb5f9139102f0e6b90a1f595ceb"
}
],
"title": "mptcp: pm: in-kernel: always mark signal+subflow endp as used",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23321",
"datePublished": "2026-03-25T10:27:15.125Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:15.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23358 (GCVE-0-2026-23358)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
drm/amdgpu: Fix error handling in slot reset
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix error handling in slot reset
If the device has not recovered after slot reset is called, it goes to
out label for error handling. There it could make decision based on
uninitialized hive pointer and could result in accessing an uninitialized
list.
Initialize the list and hive properly so that it handles the error
situation and also releases the reset domain lock which is acquired
during error_detected callback.
(cherry picked from commit bb71362182e59caa227e4192da5a612b09349696)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
732c6cefc1ecfc8de5d7a2029480798655d979d8 , < 73e8bdf14248136459753252a438177df7ed8c7c
(git)
Affected: 732c6cefc1ecfc8de5d7a2029480798655d979d8 , < baf4e7968911635eb816870af0ea587ac1457052 (git) Affected: 732c6cefc1ecfc8de5d7a2029480798655d979d8 , < b57c4ec98c17789136a4db948aec6daadceb5024 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "73e8bdf14248136459753252a438177df7ed8c7c",
"status": "affected",
"version": "732c6cefc1ecfc8de5d7a2029480798655d979d8",
"versionType": "git"
},
{
"lessThan": "baf4e7968911635eb816870af0ea587ac1457052",
"status": "affected",
"version": "732c6cefc1ecfc8de5d7a2029480798655d979d8",
"versionType": "git"
},
{
"lessThan": "b57c4ec98c17789136a4db948aec6daadceb5024",
"status": "affected",
"version": "732c6cefc1ecfc8de5d7a2029480798655d979d8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix error handling in slot reset\n\nIf the device has not recovered after slot reset is called, it goes to\nout label for error handling. There it could make decision based on\nuninitialized hive pointer and could result in accessing an uninitialized\nlist.\n\nInitialize the list and hive properly so that it handles the error\nsituation and also releases the reset domain lock which is acquired\nduring error_detected callback.\n\n(cherry picked from commit bb71362182e59caa227e4192da5a612b09349696)"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:42.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/73e8bdf14248136459753252a438177df7ed8c7c"
},
{
"url": "https://git.kernel.org/stable/c/baf4e7968911635eb816870af0ea587ac1457052"
},
{
"url": "https://git.kernel.org/stable/c/b57c4ec98c17789136a4db948aec6daadceb5024"
}
],
"title": "drm/amdgpu: Fix error handling in slot reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23358",
"datePublished": "2026-03-25T10:27:42.327Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:42.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23320 (GCVE-0-2026-23320)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
usb: gadget: f_ncm: align net_device lifecycle with bind/unbind
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: align net_device lifecycle with bind/unbind
Currently, the net_device is allocated in ncm_alloc_inst() and freed in
ncm_free_inst(). This ties the network interface's lifetime to the
configuration instance rather than the USB connection (bind/unbind).
This decoupling causes issues when the USB gadget is disconnected where
the underlying gadget device is removed. The net_device can outlive its
parent, leading to dangling sysfs links and NULL pointer dereferences
when accessing the freed gadget device.
Problem 1: NULL pointer dereference on disconnect
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000000
Call trace:
__pi_strlen+0x14/0x150
rtnl_fill_ifinfo+0x6b4/0x708
rtmsg_ifinfo_build_skb+0xd8/0x13c
rtmsg_ifinfo+0x50/0xa0
__dev_notify_flags+0x4c/0x1f0
dev_change_flags+0x54/0x70
do_setlink+0x390/0xebc
rtnl_newlink+0x7d0/0xac8
rtnetlink_rcv_msg+0x27c/0x410
netlink_rcv_skb+0x134/0x150
rtnetlink_rcv+0x18/0x28
netlink_unicast+0x254/0x3f0
netlink_sendmsg+0x2e0/0x3d4
Problem 2: Dangling sysfs symlinks
console:/ # ls -l /sys/class/net/ncm0
lrwxrwxrwx ... /sys/class/net/ncm0 ->
/sys/devices/platform/.../gadget.0/net/ncm0
console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0
ls: .../gadget.0/net/ncm0: No such file or directory
Move the net_device allocation to ncm_bind() and deallocation to
ncm_unbind(). This ensures the network interface exists only when the
gadget function is actually bound to a configuration.
To support pre-bind configuration (e.g., setting interface name or MAC
address via configfs), cache user-provided options in f_ncm_opts
using the gether_opts structure. Apply these cached settings to the
net_device upon creation in ncm_bind().
Preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget:
f_ncm: Fix UAF ncm object at re-bind after usb ep transport error").
Check opts->net in ncm_set_alt() and ncm_disable() to ensure
gether_disconnect() runs only if a connection was established.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
40d133d7f542616cf9538508a372306e626a16e9 , < b62076e780a2121903ecf9ffdfb89c64647cb7da
(git)
Affected: 40d133d7f542616cf9538508a372306e626a16e9 , < 188338c1827842f898761a939669cf345bdf07e2 (git) Affected: 40d133d7f542616cf9538508a372306e626a16e9 , < 56a512a9b4107079f68701e7d55da8507eb963d9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_ncm.c",
"drivers/usb/gadget/function/u_ncm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b62076e780a2121903ecf9ffdfb89c64647cb7da",
"status": "affected",
"version": "40d133d7f542616cf9538508a372306e626a16e9",
"versionType": "git"
},
{
"lessThan": "188338c1827842f898761a939669cf345bdf07e2",
"status": "affected",
"version": "40d133d7f542616cf9538508a372306e626a16e9",
"versionType": "git"
},
{
"lessThan": "56a512a9b4107079f68701e7d55da8507eb963d9",
"status": "affected",
"version": "40d133d7f542616cf9538508a372306e626a16e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_ncm.c",
"drivers/usb/gadget/function/u_ncm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc1",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: align net_device lifecycle with bind/unbind\n\nCurrently, the net_device is allocated in ncm_alloc_inst() and freed in\nncm_free_inst(). This ties the network interface\u0027s lifetime to the\nconfiguration instance rather than the USB connection (bind/unbind).\n\nThis decoupling causes issues when the USB gadget is disconnected where\nthe underlying gadget device is removed. The net_device can outlive its\nparent, leading to dangling sysfs links and NULL pointer dereferences\nwhen accessing the freed gadget device.\n\nProblem 1: NULL pointer dereference on disconnect\n Unable to handle kernel NULL pointer dereference at virtual address\n 0000000000000000\n Call trace:\n __pi_strlen+0x14/0x150\n rtnl_fill_ifinfo+0x6b4/0x708\n rtmsg_ifinfo_build_skb+0xd8/0x13c\n rtmsg_ifinfo+0x50/0xa0\n __dev_notify_flags+0x4c/0x1f0\n dev_change_flags+0x54/0x70\n do_setlink+0x390/0xebc\n rtnl_newlink+0x7d0/0xac8\n rtnetlink_rcv_msg+0x27c/0x410\n netlink_rcv_skb+0x134/0x150\n rtnetlink_rcv+0x18/0x28\n netlink_unicast+0x254/0x3f0\n netlink_sendmsg+0x2e0/0x3d4\n\nProblem 2: Dangling sysfs symlinks\n console:/ # ls -l /sys/class/net/ncm0\n lrwxrwxrwx ... /sys/class/net/ncm0 -\u003e\n /sys/devices/platform/.../gadget.0/net/ncm0\n console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0\n ls: .../gadget.0/net/ncm0: No such file or directory\n\nMove the net_device allocation to ncm_bind() and deallocation to\nncm_unbind(). This ensures the network interface exists only when the\ngadget function is actually bound to a configuration.\n\nTo support pre-bind configuration (e.g., setting interface name or MAC\naddress via configfs), cache user-provided options in f_ncm_opts\nusing the gether_opts structure. Apply these cached settings to the\nnet_device upon creation in ncm_bind().\n\nPreserve the use-after-free fix from commit 6334b8e4553c (\"usb: gadget:\nf_ncm: Fix UAF ncm object at re-bind after usb ep transport error\").\nCheck opts-\u003enet in ncm_set_alt() and ncm_disable() to ensure\ngether_disconnect() runs only if a connection was established."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:14.398Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b62076e780a2121903ecf9ffdfb89c64647cb7da"
},
{
"url": "https://git.kernel.org/stable/c/188338c1827842f898761a939669cf345bdf07e2"
},
{
"url": "https://git.kernel.org/stable/c/56a512a9b4107079f68701e7d55da8507eb963d9"
}
],
"title": "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23320",
"datePublished": "2026-03-25T10:27:14.398Z",
"dateReserved": "2026-01-13T15:37:45.995Z",
"dateUpdated": "2026-03-25T10:27:14.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23327 (GCVE-0-2026-23327)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
cxl_payload_from_user_allowed() casts and dereferences the input
payload without first verifying its size. When a raw mailbox command
is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,
which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,
triggering a KASAN splat:
BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683
Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258
CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xce/0x650 mm/kasan/report.c:482
kasan_report+0xce/0x100 mm/kasan/report.c:595
memcmp+0x176/0x1d0 lib/string.c:683
uuid_equal include/linux/uuid.h:73 [inline]
cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]
cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]
cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]
cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643
__cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]
cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdaf331ba79
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79
RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003
RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768
</TASK>
Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate
the payload is large enough.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/mbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
},
{
"lessThan": "60b5d1f68338aff2c5af0113f04aefa7169c50c2",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/mbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n\ncxl_payload_from_user_allowed() casts and dereferences the input\npayload without first verifying its size. When a raw mailbox command\nis sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,\nwhich expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,\ntriggering a KASAN splat:\n\nBUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683\nRead of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258\n\nCPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x650 mm/kasan/report.c:482\n kasan_report+0xce/0x100 mm/kasan/report.c:595\n memcmp+0x176/0x1d0 lib/string.c:683\n uuid_equal include/linux/uuid.h:73 [inline]\n cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]\n cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]\n cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]\n cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643\n __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]\n cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdaf331ba79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79\nRDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003\nRBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768\n \u003c/TASK\u003e\n\nAdd \u0027in_size\u0027 parameter to cxl_payload_from_user_allowed() and validate\nthe payload is large enough."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:19.815Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1"
},
{
"url": "https://git.kernel.org/stable/c/60b5d1f68338aff2c5af0113f04aefa7169c50c2"
}
],
"title": "cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23327",
"datePublished": "2026-03-25T10:27:19.815Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:19.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23388 (GCVE-0-2026-23388)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
Squashfs: check metadata block offset is within range
Summary
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check metadata block offset is within range
Syzkaller reports a "general protection fault in squashfs_copy_data"
This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.
This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.
The fix is to check that the offset is within range in
squashfs_read_metadata. This will trap this and other cases.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
f400e12656ab518be107febfe2315fb1eab5a342 , < 0c8ab092aec3ac4294940054772d30b511b16713
(git)
Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < 6b847d65f5b0065e02080c61fad93d57d6686383 (git) Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < 9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c (git) Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < 01ee0bcc29864b78249308e8b35042b09bbf5fe3 (git) Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < 3b9499e7d677dd4366239a292238489a804936b2 (git) Affected: f400e12656ab518be107febfe2315fb1eab5a342 , < fdb24a820a5832ec4532273282cbd4f22c291a0d (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/squashfs/cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c8ab092aec3ac4294940054772d30b511b16713",
"status": "affected",
"version": "f400e12656ab518be107febfe2315fb1eab5a342",
"versionType": "git"
},
{
"lessThan": "6b847d65f5b0065e02080c61fad93d57d6686383",
"status": "affected",
"version": "f400e12656ab518be107febfe2315fb1eab5a342",
"versionType": "git"
},
{
"lessThan": "9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c",
"status": "affected",
"version": "f400e12656ab518be107febfe2315fb1eab5a342",
"versionType": "git"
},
{
"lessThan": "01ee0bcc29864b78249308e8b35042b09bbf5fe3",
"status": "affected",
"version": "f400e12656ab518be107febfe2315fb1eab5a342",
"versionType": "git"
},
{
"lessThan": "3b9499e7d677dd4366239a292238489a804936b2",
"status": "affected",
"version": "f400e12656ab518be107febfe2315fb1eab5a342",
"versionType": "git"
},
{
"lessThan": "fdb24a820a5832ec4532273282cbd4f22c291a0d",
"status": "affected",
"version": "f400e12656ab518be107febfe2315fb1eab5a342",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/squashfs/cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \"general protection fault in squashfs_copy_data\"\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata. This will trap this and other cases."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:06.224Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713"
},
{
"url": "https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383"
},
{
"url": "https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c"
},
{
"url": "https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3"
},
{
"url": "https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2"
},
{
"url": "https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d"
}
],
"title": "Squashfs: check metadata block offset is within range",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23388",
"datePublished": "2026-03-25T10:28:06.224Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T10:28:06.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23393 (GCVE-0-2026-23393)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:33 – Updated: 2026-03-25 10:33
VLAI?
EPSS
Title
bridge: cfm: Fix race condition in peer_mep deletion
Summary
In the Linux kernel, the following vulnerability has been resolved:
bridge: cfm: Fix race condition in peer_mep deletion
When a peer MEP is being deleted, cancel_delayed_work_sync() is called
on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in
softirq context under rcu_read_lock (without RTNL) and can re-schedule
ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()
returning and kfree_rcu() being called.
The following is a simple race scenario:
cpu0 cpu1
mep_delete_implementation()
cancel_delayed_work_sync(ccm_rx_dwork);
br_cfm_frame_rx()
// peer_mep still in hlist
if (peer_mep->ccm_defect)
ccm_rx_timer_start()
queue_delayed_work(ccm_rx_dwork)
hlist_del_rcu(&peer_mep->head);
kfree_rcu(peer_mep, rcu);
ccm_rx_work_expired()
// on freed peer_mep
To prevent this, cancel_delayed_work_sync() is replaced with
disable_delayed_work_sync() in both peer MEP deletion paths, so
that subsequent queue_delayed_work() calls from br_cfm_frame_rx()
are silently rejected.
The cc_peer_disable() helper retains cancel_delayed_work_sync()
because it is also used for the CC enable/disable toggle path where
the work must remain re-schedulable.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
dc32cbb3dbd7da38c700d6e0fc6354df24920525 , < e89dbd2736a45f0507949af4748cbbf3ff793146
(git)
Affected: dc32cbb3dbd7da38c700d6e0fc6354df24920525 , < d8f35767bacb3c7769d470a41cf161e3f3c07e70 (git) Affected: dc32cbb3dbd7da38c700d6e0fc6354df24920525 , < 1fd81151f65927fd9edb8ecd12ad45527dbbe5ab (git) Affected: dc32cbb3dbd7da38c700d6e0fc6354df24920525 , < 3715a00855316066cdda69d43648336367422127 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e89dbd2736a45f0507949af4748cbbf3ff793146",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
},
{
"lessThan": "d8f35767bacb3c7769d470a41cf161e3f3c07e70",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
},
{
"lessThan": "1fd81151f65927fd9edb8ecd12ad45527dbbe5ab",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
},
{
"lessThan": "3715a00855316066cdda69d43648336367422127",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc5",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: cfm: Fix race condition in peer_mep deletion\n\nWhen a peer MEP is being deleted, cancel_delayed_work_sync() is called\non ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in\nsoftirq context under rcu_read_lock (without RTNL) and can re-schedule\nccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()\nreturning and kfree_rcu() being called.\n\nThe following is a simple race scenario:\n\n cpu0 cpu1\n\nmep_delete_implementation()\n cancel_delayed_work_sync(ccm_rx_dwork);\n br_cfm_frame_rx()\n // peer_mep still in hlist\n if (peer_mep-\u003eccm_defect)\n ccm_rx_timer_start()\n queue_delayed_work(ccm_rx_dwork)\n hlist_del_rcu(\u0026peer_mep-\u003ehead);\n kfree_rcu(peer_mep, rcu);\n ccm_rx_work_expired()\n // on freed peer_mep\n\nTo prevent this, cancel_delayed_work_sync() is replaced with\ndisable_delayed_work_sync() in both peer MEP deletion paths, so\nthat subsequent queue_delayed_work() calls from br_cfm_frame_rx()\nare silently rejected.\n\nThe cc_peer_disable() helper retains cancel_delayed_work_sync()\nbecause it is also used for the CC enable/disable toggle path where\nthe work must remain re-schedulable."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:33:17.407Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e89dbd2736a45f0507949af4748cbbf3ff793146"
},
{
"url": "https://git.kernel.org/stable/c/d8f35767bacb3c7769d470a41cf161e3f3c07e70"
},
{
"url": "https://git.kernel.org/stable/c/1fd81151f65927fd9edb8ecd12ad45527dbbe5ab"
},
{
"url": "https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"
}
],
"title": "bridge: cfm: Fix race condition in peer_mep deletion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23393",
"datePublished": "2026-03-25T10:33:17.407Z",
"dateReserved": "2026-01-13T15:37:46.011Z",
"dateUpdated": "2026-03-25T10:33:17.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23394 (GCVE-0-2026-23394)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:33 – Updated: 2026-03-25 10:33
VLAI?
EPSS
Title
af_unix: Give up GC if MSG_PEEK intervened.
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Give up GC if MSG_PEEK intervened.
Igor Ushakov reported that GC purged the receive queue of
an alive socket due to a race with MSG_PEEK with a nice repro.
This is the exact same issue previously fixed by commit
cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK").
After GC was replaced with the current algorithm, the cited
commit removed the locking dance in unix_peek_fds() and
reintroduced the same issue.
The problem is that MSG_PEEK bumps a file refcount without
interacting with GC.
Consider an SCC containing sk-A and sk-B, where sk-A is
close()d but can be recv()ed via sk-B.
The bad thing happens if sk-A is recv()ed with MSG_PEEK from
sk-B and sk-B is close()d while GC is checking unix_vertex_dead()
for sk-A and sk-B.
GC thread User thread
--------- -----------
unix_vertex_dead(sk-A)
-> true <------.
\
`------ recv(sk-B, MSG_PEEK)
invalidate !! -> sk-A's file refcount : 1 -> 2
close(sk-B)
-> sk-B's file refcount : 2 -> 1
unix_vertex_dead(sk-B)
-> true
Initially, sk-A's file refcount is 1 by the inflight fd in sk-B
recvq. GC thinks sk-A is dead because the file refcount is the
same as the number of its inflight fds.
However, sk-A's file refcount is bumped silently by MSG_PEEK,
which invalidates the previous evaluation.
At this moment, sk-B's file refcount is 2; one by the open fd,
and one by the inflight fd in sk-A. The subsequent close()
releases one refcount by the former.
Finally, GC incorrectly concludes that both sk-A and sk-B are dead.
One option is to restore the locking dance in unix_peek_fds(),
but we can resolve this more elegantly thanks to the new algorithm.
The point is that the issue does not occur without the subsequent
close() and we actually do not need to synchronise MSG_PEEK with
the dead SCC detection.
When the issue occurs, close() and GC touch the same file refcount.
If GC sees the refcount being decremented by close(), it can just
give up garbage-collecting the SCC.
Therefore, we only need to signal the race during MSG_PEEK with
a proper memory barrier to make it visible to the GC.
Let's use seqcount_t to notify GC when MSG_PEEK occurs and let
it defer the SCC to the next run.
This way no locking is needed on the MSG_PEEK side, and we can
avoid imposing a penalty on every MSG_PEEK unnecessarily.
Note that we can retry within unix_scc_dead() if MSG_PEEK is
detected, but we do not do so to avoid hung task splat from
abusive MSG_PEEK calls.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
118f457da9ed58a79e24b73c2ef0aa1987241f0e , < 37dd7ab332396eb8dd80b2dc7ea4b61abf767436
(git)
Affected: 118f457da9ed58a79e24b73c2ef0aa1987241f0e , < e5b31d988a41549037b8d8721a3c3cae893d8670 (git) Affected: 61a75360dca93c945ef6bd757f8b8a96f39b77cb (git) Affected: 7b1ffbd3b22e755d481d49647dcb7c5cfbde5844 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c",
"net/unix/af_unix.h",
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37dd7ab332396eb8dd80b2dc7ea4b61abf767436",
"status": "affected",
"version": "118f457da9ed58a79e24b73c2ef0aa1987241f0e",
"versionType": "git"
},
{
"lessThan": "e5b31d988a41549037b8d8721a3c3cae893d8670",
"status": "affected",
"version": "118f457da9ed58a79e24b73c2ef0aa1987241f0e",
"versionType": "git"
},
{
"status": "affected",
"version": "61a75360dca93c945ef6bd757f8b8a96f39b77cb",
"versionType": "git"
},
{
"status": "affected",
"version": "7b1ffbd3b22e755d481d49647dcb7c5cfbde5844",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c",
"net/unix/af_unix.h",
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc5",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.93",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Give up GC if MSG_PEEK intervened.\n\nIgor Ushakov reported that GC purged the receive queue of\nan alive socket due to a race with MSG_PEEK with a nice repro.\n\nThis is the exact same issue previously fixed by commit\ncbcf01128d0a (\"af_unix: fix garbage collect vs MSG_PEEK\").\n\nAfter GC was replaced with the current algorithm, the cited\ncommit removed the locking dance in unix_peek_fds() and\nreintroduced the same issue.\n\nThe problem is that MSG_PEEK bumps a file refcount without\ninteracting with GC.\n\nConsider an SCC containing sk-A and sk-B, where sk-A is\nclose()d but can be recv()ed via sk-B.\n\nThe bad thing happens if sk-A is recv()ed with MSG_PEEK from\nsk-B and sk-B is close()d while GC is checking unix_vertex_dead()\nfor sk-A and sk-B.\n\n GC thread User thread\n --------- -----------\n unix_vertex_dead(sk-A)\n -\u003e true \u003c------.\n \\\n `------ recv(sk-B, MSG_PEEK)\n invalidate !! -\u003e sk-A\u0027s file refcount : 1 -\u003e 2\n\n close(sk-B)\n -\u003e sk-B\u0027s file refcount : 2 -\u003e 1\n unix_vertex_dead(sk-B)\n -\u003e true\n\nInitially, sk-A\u0027s file refcount is 1 by the inflight fd in sk-B\nrecvq. GC thinks sk-A is dead because the file refcount is the\nsame as the number of its inflight fds.\n\nHowever, sk-A\u0027s file refcount is bumped silently by MSG_PEEK,\nwhich invalidates the previous evaluation.\n\nAt this moment, sk-B\u0027s file refcount is 2; one by the open fd,\nand one by the inflight fd in sk-A. The subsequent close()\nreleases one refcount by the former.\n\nFinally, GC incorrectly concludes that both sk-A and sk-B are dead.\n\nOne option is to restore the locking dance in unix_peek_fds(),\nbut we can resolve this more elegantly thanks to the new algorithm.\n\nThe point is that the issue does not occur without the subsequent\nclose() and we actually do not need to synchronise MSG_PEEK with\nthe dead SCC detection.\n\nWhen the issue occurs, close() and GC touch the same file refcount.\nIf GC sees the refcount being decremented by close(), it can just\ngive up garbage-collecting the SCC.\n\nTherefore, we only need to signal the race during MSG_PEEK with\na proper memory barrier to make it visible to the GC.\n\nLet\u0027s use seqcount_t to notify GC when MSG_PEEK occurs and let\nit defer the SCC to the next run.\n\nThis way no locking is needed on the MSG_PEEK side, and we can\navoid imposing a penalty on every MSG_PEEK unnecessarily.\n\nNote that we can retry within unix_scc_dead() if MSG_PEEK is\ndetected, but we do not do so to avoid hung task splat from\nabusive MSG_PEEK calls."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:33:18.180Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37dd7ab332396eb8dd80b2dc7ea4b61abf767436"
},
{
"url": "https://git.kernel.org/stable/c/e5b31d988a41549037b8d8721a3c3cae893d8670"
}
],
"title": "af_unix: Give up GC if MSG_PEEK intervened.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23394",
"datePublished": "2026-03-25T10:33:18.180Z",
"dateReserved": "2026-01-13T15:37:46.011Z",
"dateUpdated": "2026-03-25T10:33:18.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23323 (GCVE-0-2026-23323)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver
The recently added macsmc-hwmon driver contained several critical
bugs in its sensor population logic and float conversion routines.
Specifically:
- The voltage sensor population loop used the wrong prefix ("volt-"
instead of "voltage-") and incorrectly assigned sensors to the
temperature sensor array (hwmon->temp.sensors) instead of the
voltage sensor array (hwmon->volt.sensors). This would lead to
out-of-bounds memory access or data corruption when both temperature
and voltage sensors were present.
- The float conversion in macsmc_hwmon_write_f32() had flawed exponent
logic for values >= 2^24 and lacked masking for the mantissa, which
could lead to incorrect values being written to the SMC.
Fix these issues to ensure correct sensor registration and reliable
manual fan control.
Confirm that the reported overflow in FIELD_PREP is fixed by declaring
macsmc_hwmon_write_f32() as __always_inline for a compile test.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/macsmc-hwmon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "625ef35b70d3883fb9a41cd5a988e64dd3e447d6",
"status": "affected",
"version": "785205fd81399bd8e49065aee3362a99d5702321",
"versionType": "git"
},
{
"lessThan": "5dd69b864911ae3847365e8bafe7854e79fbeecb",
"status": "affected",
"version": "785205fd81399bd8e49065aee3362a99d5702321",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/macsmc-hwmon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver\n\nThe recently added macsmc-hwmon driver contained several critical\nbugs in its sensor population logic and float conversion routines.\n\nSpecifically:\n- The voltage sensor population loop used the wrong prefix (\"volt-\"\n instead of \"voltage-\") and incorrectly assigned sensors to the\n temperature sensor array (hwmon-\u003etemp.sensors) instead of the\n voltage sensor array (hwmon-\u003evolt.sensors). This would lead to\n out-of-bounds memory access or data corruption when both temperature\n and voltage sensors were present.\n- The float conversion in macsmc_hwmon_write_f32() had flawed exponent\n logic for values \u003e= 2^24 and lacked masking for the mantissa, which\n could lead to incorrect values being written to the SMC.\n\nFix these issues to ensure correct sensor registration and reliable\nmanual fan control.\n\nConfirm that the reported overflow in FIELD_PREP is fixed by declaring\nmacsmc_hwmon_write_f32() as __always_inline for a compile test."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:16.697Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/625ef35b70d3883fb9a41cd5a988e64dd3e447d6"
},
{
"url": "https://git.kernel.org/stable/c/5dd69b864911ae3847365e8bafe7854e79fbeecb"
}
],
"title": "hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23323",
"datePublished": "2026-03-25T10:27:16.697Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:16.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23294 (GCVE-0-2026-23294)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
bpf: Fix race in devmap on PREEMPT_RT
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix race in devmap on PREEMPT_RT
On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be
accessed concurrently by multiple preemptible tasks on the same CPU.
The original code assumes bq_enqueue() and __dev_flush() run atomically
with respect to each other on the same CPU, relying on
local_bh_disable() to prevent preemption. However, on PREEMPT_RT,
local_bh_disable() only calls migrate_disable() (when
PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable
preemption, which allows CFS scheduling to preempt a task during
bq_xmit_all(), enabling another task on the same CPU to enter
bq_enqueue() and operate on the same per-CPU bq concurrently.
This leads to several races:
1. Double-free / use-after-free on bq->q[]: bq_xmit_all() snapshots
cnt = bq->count, then iterates bq->q[0..cnt-1] to transmit frames.
If preempted after the snapshot, a second task can call bq_enqueue()
-> bq_xmit_all() on the same bq, transmitting (and freeing) the
same frames. When the first task resumes, it operates on stale
pointers in bq->q[], causing use-after-free.
2. bq->count and bq->q[] corruption: concurrent bq_enqueue() modifying
bq->count and bq->q[] while bq_xmit_all() is reading them.
3. dev_rx/xdp_prog teardown race: __dev_flush() clears bq->dev_rx and
bq->xdp_prog after bq_xmit_all(). If preempted between
bq_xmit_all() return and bq->dev_rx = NULL, a preempting
bq_enqueue() sees dev_rx still set (non-NULL), skips adding bq to
the flush_list, and enqueues a frame. When __dev_flush() resumes,
it clears dev_rx and removes bq from the flush_list, orphaning the
newly enqueued frame.
4. __list_del_clearprev() on flush_node: similar to the cpumap race,
both tasks can call __list_del_clearprev() on the same flush_node,
the second dereferences the prev pointer already set to NULL.
The race between task A (__dev_flush -> bq_xmit_all) and task B
(bq_enqueue -> bq_xmit_all) on the same CPU:
Task A (xdp_do_flush) Task B (ndo_xdp_xmit redirect)
---------------------- --------------------------------
__dev_flush(flush_list)
bq_xmit_all(bq)
cnt = bq->count /* e.g. 16 */
/* start iterating bq->q[] */
<-- CFS preempts Task A -->
bq_enqueue(dev, xdpf)
bq->count == DEV_MAP_BULK_SIZE
bq_xmit_all(bq, 0)
cnt = bq->count /* same 16! */
ndo_xdp_xmit(bq->q[])
/* frames freed by driver */
bq->count = 0
<-- Task A resumes -->
ndo_xdp_xmit(bq->q[])
/* use-after-free: frames already freed! */
Fix this by adding a local_lock_t to xdp_dev_bulk_queue and acquiring
it in bq_enqueue() and __dev_flush(). These paths already run under
local_bh_disable(), so use local_lock_nested_bh() which on non-RT is
a pure annotation with no overhead, and on PREEMPT_RT provides a
per-CPU sleeping lock that serializes access to the bq.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3253cb49cbad4772389d6ef55be75db1f97da910 , < 6c10b019785dc282c5f45d21e4a3f468b8fd6476
(git)
Affected: 3253cb49cbad4772389d6ef55be75db1f97da910 , < ab1a56c9d99189aa5c6e03940d06e40ba6a28240 (git) Affected: 3253cb49cbad4772389d6ef55be75db1f97da910 , < 1872e75375c40add4a35990de3be77b5741c252c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c10b019785dc282c5f45d21e4a3f468b8fd6476",
"status": "affected",
"version": "3253cb49cbad4772389d6ef55be75db1f97da910",
"versionType": "git"
},
{
"lessThan": "ab1a56c9d99189aa5c6e03940d06e40ba6a28240",
"status": "affected",
"version": "3253cb49cbad4772389d6ef55be75db1f97da910",
"versionType": "git"
},
{
"lessThan": "1872e75375c40add4a35990de3be77b5741c252c",
"status": "affected",
"version": "3253cb49cbad4772389d6ef55be75db1f97da910",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix race in devmap on PREEMPT_RT\n\nOn PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be\naccessed concurrently by multiple preemptible tasks on the same CPU.\n\nThe original code assumes bq_enqueue() and __dev_flush() run atomically\nwith respect to each other on the same CPU, relying on\nlocal_bh_disable() to prevent preemption. However, on PREEMPT_RT,\nlocal_bh_disable() only calls migrate_disable() (when\nPREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable\npreemption, which allows CFS scheduling to preempt a task during\nbq_xmit_all(), enabling another task on the same CPU to enter\nbq_enqueue() and operate on the same per-CPU bq concurrently.\n\nThis leads to several races:\n\n1. Double-free / use-after-free on bq-\u003eq[]: bq_xmit_all() snapshots\n cnt = bq-\u003ecount, then iterates bq-\u003eq[0..cnt-1] to transmit frames.\n If preempted after the snapshot, a second task can call bq_enqueue()\n -\u003e bq_xmit_all() on the same bq, transmitting (and freeing) the\n same frames. When the first task resumes, it operates on stale\n pointers in bq-\u003eq[], causing use-after-free.\n\n2. bq-\u003ecount and bq-\u003eq[] corruption: concurrent bq_enqueue() modifying\n bq-\u003ecount and bq-\u003eq[] while bq_xmit_all() is reading them.\n\n3. dev_rx/xdp_prog teardown race: __dev_flush() clears bq-\u003edev_rx and\n bq-\u003exdp_prog after bq_xmit_all(). If preempted between\n bq_xmit_all() return and bq-\u003edev_rx = NULL, a preempting\n bq_enqueue() sees dev_rx still set (non-NULL), skips adding bq to\n the flush_list, and enqueues a frame. When __dev_flush() resumes,\n it clears dev_rx and removes bq from the flush_list, orphaning the\n newly enqueued frame.\n\n4. __list_del_clearprev() on flush_node: similar to the cpumap race,\n both tasks can call __list_del_clearprev() on the same flush_node,\n the second dereferences the prev pointer already set to NULL.\n\nThe race between task A (__dev_flush -\u003e bq_xmit_all) and task B\n(bq_enqueue -\u003e bq_xmit_all) on the same CPU:\n\n Task A (xdp_do_flush) Task B (ndo_xdp_xmit redirect)\n ---------------------- --------------------------------\n __dev_flush(flush_list)\n bq_xmit_all(bq)\n cnt = bq-\u003ecount /* e.g. 16 */\n /* start iterating bq-\u003eq[] */\n \u003c-- CFS preempts Task A --\u003e\n bq_enqueue(dev, xdpf)\n bq-\u003ecount == DEV_MAP_BULK_SIZE\n bq_xmit_all(bq, 0)\n cnt = bq-\u003ecount /* same 16! */\n ndo_xdp_xmit(bq-\u003eq[])\n /* frames freed by driver */\n bq-\u003ecount = 0\n \u003c-- Task A resumes --\u003e\n ndo_xdp_xmit(bq-\u003eq[])\n /* use-after-free: frames already freed! */\n\nFix this by adding a local_lock_t to xdp_dev_bulk_queue and acquiring\nit in bq_enqueue() and __dev_flush(). These paths already run under\nlocal_bh_disable(), so use local_lock_nested_bh() which on non-RT is\na pure annotation with no overhead, and on PREEMPT_RT provides a\nper-CPU sleeping lock that serializes access to the bq."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:51.946Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c10b019785dc282c5f45d21e4a3f468b8fd6476"
},
{
"url": "https://git.kernel.org/stable/c/ab1a56c9d99189aa5c6e03940d06e40ba6a28240"
},
{
"url": "https://git.kernel.org/stable/c/1872e75375c40add4a35990de3be77b5741c252c"
}
],
"title": "bpf: Fix race in devmap on PREEMPT_RT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23294",
"datePublished": "2026-03-25T10:26:51.946Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:51.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23372 (GCVE-0-2026-23372)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
nfc: rawsock: cancel tx_work before socket teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: rawsock: cancel tx_work before socket teardown
In rawsock_release(), cancel any pending tx_work and purge the write
queue before orphaning the socket. rawsock_tx_work runs on the system
workqueue and calls nfc_data_exchange which dereferences the NCI
device. Without synchronization, tx_work can race with socket and
device teardown when a process is killed (e.g. by SIGKILL), leading
to use-after-free or leaked references.
Set SEND_SHUTDOWN first so that if tx_work is already running it will
see the flag and skip transmitting, then use cancel_work_sync to wait
for any in-progress execution to finish, and finally purge any
remaining queued skbs.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
23b7869c0fd08d73c9f83a2db88a13312d6198bb , < 3ae592ed91bb4b6b51df256b51045c13d2656049
(git)
Affected: 23b7869c0fd08d73c9f83a2db88a13312d6198bb , < 722a28b635ec281bb08a23885223526d8e7d6526 (git) Affected: 23b7869c0fd08d73c9f83a2db88a13312d6198bb , < 78141b8832e16d80d09cbefb4258612db0777a24 (git) Affected: 23b7869c0fd08d73c9f83a2db88a13312d6198bb , < edc988613def90c5b558e025b1b423f48007be06 (git) Affected: 23b7869c0fd08d73c9f83a2db88a13312d6198bb , < da4515fc8263c5933ed605e396af91079806dc45 (git) Affected: 23b7869c0fd08d73c9f83a2db88a13312d6198bb , < d793458c45df2aed498d7f74145eab7ee22d25aa (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/rawsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ae592ed91bb4b6b51df256b51045c13d2656049",
"status": "affected",
"version": "23b7869c0fd08d73c9f83a2db88a13312d6198bb",
"versionType": "git"
},
{
"lessThan": "722a28b635ec281bb08a23885223526d8e7d6526",
"status": "affected",
"version": "23b7869c0fd08d73c9f83a2db88a13312d6198bb",
"versionType": "git"
},
{
"lessThan": "78141b8832e16d80d09cbefb4258612db0777a24",
"status": "affected",
"version": "23b7869c0fd08d73c9f83a2db88a13312d6198bb",
"versionType": "git"
},
{
"lessThan": "edc988613def90c5b558e025b1b423f48007be06",
"status": "affected",
"version": "23b7869c0fd08d73c9f83a2db88a13312d6198bb",
"versionType": "git"
},
{
"lessThan": "da4515fc8263c5933ed605e396af91079806dc45",
"status": "affected",
"version": "23b7869c0fd08d73c9f83a2db88a13312d6198bb",
"versionType": "git"
},
{
"lessThan": "d793458c45df2aed498d7f74145eab7ee22d25aa",
"status": "affected",
"version": "23b7869c0fd08d73c9f83a2db88a13312d6198bb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/rawsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: rawsock: cancel tx_work before socket teardown\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket. rawsock_tx_work runs on the system\nworkqueue and calls nfc_data_exchange which dereferences the NCI\ndevice. Without synchronization, tx_work can race with socket and\ndevice teardown when a process is killed (e.g. by SIGKILL), leading\nto use-after-free or leaked references.\n\nSet SEND_SHUTDOWN first so that if tx_work is already running it will\nsee the flag and skip transmitting, then use cancel_work_sync to wait\nfor any in-progress execution to finish, and finally purge any\nremaining queued skbs."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:53.308Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049"
},
{
"url": "https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526"
},
{
"url": "https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24"
},
{
"url": "https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06"
},
{
"url": "https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45"
},
{
"url": "https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa"
}
],
"title": "nfc: rawsock: cancel tx_work before socket teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23372",
"datePublished": "2026-03-25T10:27:53.308Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:53.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23317 (GCVE-0-2026-23317)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
Before the referenced fixes these functions used a lookup function that
returned a pointer. This was changed to another lookup function that
returned an error code with the pointer becoming an out parameter.
The error path when the lookup failed was not changed to reflect this
change and the code continued to return the PTR_ERR of the now
uninitialized pointer. This could cause the vmw_translate_ptr functions
to return success when they actually failed causing further uninitialized
and OOB accesses.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
7ac9578e45b20e3f3c0c8eb71f5417a499a7226a , < ce3a5cf139787c186d5d54336107298cacaad2b9
(git)
Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 7e55d0788b362c93660b80cc5603031bbbdefa98 (git) Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 36cb28b6d303a81e6ed4536017090e85e0143e42 (git) Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 531f45589787799aa81b63e1e1f8e71db5d93dd1 (git) Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 149f028772fa2879d9316b924ce948a6a0877e45 (git) Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 5023ca80f9589295cb60735016e39fc5cc714243 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce3a5cf139787c186d5d54336107298cacaad2b9",
"status": "affected",
"version": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a",
"versionType": "git"
},
{
"lessThan": "7e55d0788b362c93660b80cc5603031bbbdefa98",
"status": "affected",
"version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
"versionType": "git"
},
{
"lessThan": "36cb28b6d303a81e6ed4536017090e85e0143e42",
"status": "affected",
"version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
"versionType": "git"
},
{
"lessThan": "531f45589787799aa81b63e1e1f8e71db5d93dd1",
"status": "affected",
"version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
"versionType": "git"
},
{
"lessThan": "149f028772fa2879d9316b924ce948a6a0877e45",
"status": "affected",
"version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
"versionType": "git"
},
{
"lessThan": "5023ca80f9589295cb60735016e39fc5cc714243",
"status": "affected",
"version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Return the correct value in vmw_translate_ptr functions\n\nBefore the referenced fixes these functions used a lookup function that\nreturned a pointer. This was changed to another lookup function that\nreturned an error code with the pointer becoming an out parameter.\n\nThe error path when the lookup failed was not changed to reflect this\nchange and the code continued to return the PTR_ERR of the now\nuninitialized pointer. This could cause the vmw_translate_ptr functions\nto return success when they actually failed causing further uninitialized\nand OOB accesses."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:11.884Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce3a5cf139787c186d5d54336107298cacaad2b9"
},
{
"url": "https://git.kernel.org/stable/c/7e55d0788b362c93660b80cc5603031bbbdefa98"
},
{
"url": "https://git.kernel.org/stable/c/36cb28b6d303a81e6ed4536017090e85e0143e42"
},
{
"url": "https://git.kernel.org/stable/c/531f45589787799aa81b63e1e1f8e71db5d93dd1"
},
{
"url": "https://git.kernel.org/stable/c/149f028772fa2879d9316b924ce948a6a0877e45"
},
{
"url": "https://git.kernel.org/stable/c/5023ca80f9589295cb60735016e39fc5cc714243"
}
],
"title": "drm/vmwgfx: Return the correct value in vmw_translate_ptr functions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23317",
"datePublished": "2026-03-25T10:27:11.884Z",
"dateReserved": "2026-01-13T15:37:45.995Z",
"dateUpdated": "2026-03-25T10:27:11.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23347 (GCVE-0-2026-23347)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
can: usb: f81604: correctly anchor the urb in the read bulk callback
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: correctly anchor the urb in the read bulk callback
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
88da17436973e463bed59bea79771fb03a21555e , < 54ee74307165b348b2fddcd7942eb48fb4ee1237
(git)
Affected: 88da17436973e463bed59bea79771fb03a21555e , < c001214e12202338425d6dda5d2a1919d674282d (git) Affected: 88da17436973e463bed59bea79771fb03a21555e , < f6d80b104f904a6da922907394eec66d3e2ffc57 (git) Affected: 88da17436973e463bed59bea79771fb03a21555e , < 7724645c4792914cd07f36718816c5369cc57970 (git) Affected: 88da17436973e463bed59bea79771fb03a21555e , < 952caa5da10bed22be09612433964f6877ba0dde (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/f81604.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54ee74307165b348b2fddcd7942eb48fb4ee1237",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "c001214e12202338425d6dda5d2a1919d674282d",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "f6d80b104f904a6da922907394eec66d3e2ffc57",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "7724645c4792914cd07f36718816c5369cc57970",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "952caa5da10bed22be09612433964f6877ba0dde",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/f81604.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: usb: f81604: correctly anchor the urb in the read bulk callback\n\nWhen submitting an urb, that is using the anchor pattern, it needs to be\nanchored before submitting it otherwise it could be leaked if\nusb_kill_anchored_urbs() is called. This logic is correctly done\nelsewhere in the driver, except in the read bulk callback so do that\nhere also."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:33.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54ee74307165b348b2fddcd7942eb48fb4ee1237"
},
{
"url": "https://git.kernel.org/stable/c/c001214e12202338425d6dda5d2a1919d674282d"
},
{
"url": "https://git.kernel.org/stable/c/f6d80b104f904a6da922907394eec66d3e2ffc57"
},
{
"url": "https://git.kernel.org/stable/c/7724645c4792914cd07f36718816c5369cc57970"
},
{
"url": "https://git.kernel.org/stable/c/952caa5da10bed22be09612433964f6877ba0dde"
}
],
"title": "can: usb: f81604: correctly anchor the urb in the read bulk callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23347",
"datePublished": "2026-03-25T10:27:33.753Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:33.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23302 (GCVE-0-2026-23302)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
net: annotate data-races around sk->sk_{data_ready,write_space}
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: annotate data-races around sk->sk_{data_ready,write_space}
skmsg (and probably other layers) are changing these pointers
while other cpus might read them concurrently.
Add corresponding READ_ONCE()/WRITE_ONCE() annotations
for UDP, TCP and AF_UNIX.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
604326b41a6fb9b4a78b6179335decee0365cd8c , < f17c1c4acbe2bd702abce73a847a04a196fab2c5
(git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 27fccdbcbbfc4651b6f66756e6fa3f52e051ec23 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 2ef2b20cf4e04ac8a6ba68493f8780776ff84300 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c",
"net/ipv4/tcp.c",
"net/ipv4/tcp_bpf.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv4/udp.c",
"net/ipv4/udp_bpf.c",
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f17c1c4acbe2bd702abce73a847a04a196fab2c5",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "27fccdbcbbfc4651b6f66756e6fa3f52e051ec23",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "2ef2b20cf4e04ac8a6ba68493f8780776ff84300",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c",
"net/ipv4/tcp.c",
"net/ipv4/tcp_bpf.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv4/udp.c",
"net/ipv4/udp_bpf.c",
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: annotate data-races around sk-\u003esk_{data_ready,write_space}\n\nskmsg (and probably other layers) are changing these pointers\nwhile other cpus might read them concurrently.\n\nAdd corresponding READ_ONCE()/WRITE_ONCE() annotations\nfor UDP, TCP and AF_UNIX."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:57.470Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f17c1c4acbe2bd702abce73a847a04a196fab2c5"
},
{
"url": "https://git.kernel.org/stable/c/27fccdbcbbfc4651b6f66756e6fa3f52e051ec23"
},
{
"url": "https://git.kernel.org/stable/c/2ef2b20cf4e04ac8a6ba68493f8780776ff84300"
}
],
"title": "net: annotate data-races around sk-\u003esk_{data_ready,write_space}",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23302",
"datePublished": "2026-03-25T10:26:57.470Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:57.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23390 (GCVE-0-2026-23390)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:29 – Updated: 2026-03-25 16:49
VLAI?
EPSS
Title
tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
The dma_map_sg tracepoint can trigger a perf buffer overflow when
tracing large scatter-gather lists. With devices like virtio-gpu
creating large DRM buffers, nents can exceed 1000 entries, resulting
in:
phys_addrs: 1000 * 8 bytes = 8,000 bytes
dma_addrs: 1000 * 8 bytes = 8,000 bytes
lengths: 1000 * 4 bytes = 4,000 bytes
Total: ~20,000 bytes
This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing:
WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405
perf buffer not large enough, wanted 24620, have 8192
Cap all three dynamic arrays at 128 entries using min() in the array
size calculation. This ensures arrays are only as large as needed
(up to the cap), avoiding unnecessary memory allocation for small
operations while preventing overflow for large ones.
The tracepoint now records the full nents/ents counts and a truncated
flag so users can see when data has been capped.
Changes in v2:
- Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing
instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from
Steven Rostedt)
- This allocates only what's needed up to the cap, avoiding waste
for small operations
Reviwed-by: Sean Anderson <sean.anderson@linux.dev>
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
038eb433dc1474c4bc7d33188294e3d4778efdfd , < 02d209bb018a40dee9eac89e91860253dee9605b
(git)
Affected: 038eb433dc1474c4bc7d33188294e3d4778efdfd , < f2584f791a10343bdc995ff6ff402db45b95de69 (git) Affected: 038eb433dc1474c4bc7d33188294e3d4778efdfd , < daafcc0ef0b358d9d622b6e3b7c43767aa3814ee (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/trace/events/dma.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02d209bb018a40dee9eac89e91860253dee9605b",
"status": "affected",
"version": "038eb433dc1474c4bc7d33188294e3d4778efdfd",
"versionType": "git"
},
{
"lessThan": "f2584f791a10343bdc995ff6ff402db45b95de69",
"status": "affected",
"version": "038eb433dc1474c4bc7d33188294e3d4778efdfd",
"versionType": "git"
},
{
"lessThan": "daafcc0ef0b358d9d622b6e3b7c43767aa3814ee",
"status": "affected",
"version": "038eb433dc1474c4bc7d33188294e3d4778efdfd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/trace/events/dma.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.74",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.74",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow\n\nThe dma_map_sg tracepoint can trigger a perf buffer overflow when\ntracing large scatter-gather lists. With devices like virtio-gpu\ncreating large DRM buffers, nents can exceed 1000 entries, resulting\nin:\n\n phys_addrs: 1000 * 8 bytes = 8,000 bytes\n dma_addrs: 1000 * 8 bytes = 8,000 bytes\n lengths: 1000 * 4 bytes = 4,000 bytes\n Total: ~20,000 bytes\n\nThis exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing:\n\n WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405\n perf buffer not large enough, wanted 24620, have 8192\n\nCap all three dynamic arrays at 128 entries using min() in the array\nsize calculation. This ensures arrays are only as large as needed\n(up to the cap), avoiding unnecessary memory allocation for small\noperations while preventing overflow for large ones.\n\nThe tracepoint now records the full nents/ents counts and a truncated\nflag so users can see when data has been capped.\n\nChanges in v2:\n- Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing\n instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from\n Steven Rostedt)\n- This allocates only what\u0027s needed up to the cap, avoiding waste\n for small operations\n\nReviwed-by: Sean Anderson \u003csean.anderson@linux.dev\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:49:17.786Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02d209bb018a40dee9eac89e91860253dee9605b"
},
{
"url": "https://git.kernel.org/stable/c/f2584f791a10343bdc995ff6ff402db45b95de69"
},
{
"url": "https://git.kernel.org/stable/c/daafcc0ef0b358d9d622b6e3b7c43767aa3814ee"
}
],
"title": "tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23390",
"datePublished": "2026-03-25T10:29:02.768Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T16:49:17.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23387 (GCVE-0-2026-23387)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
devm_add_action_or_reset() already invokes the action on failure,
so the explicit put causes a double-put.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
9026f31a520d43cc01eb1c08938fc19efadd78cc , < 95b14ecc56881dd9a187e1e84dd0daa88ff22c5d
(git)
Affected: 36f91eeffd03f5c52406e0c4e2e0fb040307d00c , < 188ba3468cb7c098c62609d82e9fc58d29ead7f4 (git) Affected: 9b07cdf86a0b90556f5b68a6b20b35833b558df3 , < ea07fcfbba4301839db3784f09955d9fa3e98090 (git) Affected: 9b07cdf86a0b90556f5b68a6b20b35833b558df3 , < 1e0465139fd9caee7ffefe285ef7d5f21919e474 (git) Affected: 9b07cdf86a0b90556f5b68a6b20b35833b558df3 , < fd5bed798f45eb3a178ad527b43ab92705faaf8a (git) Affected: d7adbba9298fd74dde0abed5c93312c08c9e6507 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/cirrus/pinctrl-cs42l43.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95b14ecc56881dd9a187e1e84dd0daa88ff22c5d",
"status": "affected",
"version": "9026f31a520d43cc01eb1c08938fc19efadd78cc",
"versionType": "git"
},
{
"lessThan": "188ba3468cb7c098c62609d82e9fc58d29ead7f4",
"status": "affected",
"version": "36f91eeffd03f5c52406e0c4e2e0fb040307d00c",
"versionType": "git"
},
{
"lessThan": "ea07fcfbba4301839db3784f09955d9fa3e98090",
"status": "affected",
"version": "9b07cdf86a0b90556f5b68a6b20b35833b558df3",
"versionType": "git"
},
{
"lessThan": "1e0465139fd9caee7ffefe285ef7d5f21919e474",
"status": "affected",
"version": "9b07cdf86a0b90556f5b68a6b20b35833b558df3",
"versionType": "git"
},
{
"lessThan": "fd5bed798f45eb3a178ad527b43ab92705faaf8a",
"status": "affected",
"version": "9b07cdf86a0b90556f5b68a6b20b35833b558df3",
"versionType": "git"
},
{
"status": "affected",
"version": "d7adbba9298fd74dde0abed5c93312c08c9e6507",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/cirrus/pinctrl-cs42l43.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.12.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()\n\ndevm_add_action_or_reset() already invokes the action on failure,\nso the explicit put causes a double-put."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:05.031Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95b14ecc56881dd9a187e1e84dd0daa88ff22c5d"
},
{
"url": "https://git.kernel.org/stable/c/188ba3468cb7c098c62609d82e9fc58d29ead7f4"
},
{
"url": "https://git.kernel.org/stable/c/ea07fcfbba4301839db3784f09955d9fa3e98090"
},
{
"url": "https://git.kernel.org/stable/c/1e0465139fd9caee7ffefe285ef7d5f21919e474"
},
{
"url": "https://git.kernel.org/stable/c/fd5bed798f45eb3a178ad527b43ab92705faaf8a"
}
],
"title": "pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23387",
"datePublished": "2026-03-25T10:28:05.031Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T10:28:05.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23308 (GCVE-0-2026-23308)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
pinctrl: equilibrium: fix warning trace on load
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: equilibrium: fix warning trace on load
The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also
called in the callback function 'eqbr_irq_mask_ack()'. This is done to
avoid source code duplication. The problem, is that in the function
'eqbr_irq_mask()' also calles the gpiolib function 'gpiochip_disable_irq()'
This generates the following warning trace in the log for every gpio on
load.
[ 6.088111] ------------[ cut here ]------------
[ 6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50
[ 6.097847] Modules linked in:
[ 6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.59+ #0
[ 6.097847] Tainted: [W]=WARN
[ 6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50
[ 6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 <0f> 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
[ 6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046
[ 6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008
[ 6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0
[ 6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000
[ 6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514
[ 6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000
[ 6.097847] FS: 0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000
[ 6.097847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0
[ 6.097847] Call Trace:
[ 6.097847] <TASK>
[ 6.097847] ? eqbr_irq_mask+0x63/0x70
[ 6.097847] ? no_action+0x10/0x10
[ 6.097847] eqbr_irq_mask_ack+0x11/0x60
In an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the
interrupt is not disabled here.
To fix this, do not call the 'eqbr_irq_mask()' and 'eqbr_irq_ack()'
function. Implement instead this directly without disabling the interrupts.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
52066a53bd116a2f41d04d99b5095c02ad8cf953 , < 896449ad9053a42c6c710aeae6175170176cabd0
(git)
Affected: 52066a53bd116a2f41d04d99b5095c02ad8cf953 , < af3b0ec98dc1133521b612f8009fdd36b612aabe (git) Affected: 52066a53bd116a2f41d04d99b5095c02ad8cf953 , < 53eba152810ef0fff8567b13ea0f62d48e62df6b (git) Affected: 52066a53bd116a2f41d04d99b5095c02ad8cf953 , < ec54546e8d8a50a9824c139a127a8459d1b0b1bb (git) Affected: 52066a53bd116a2f41d04d99b5095c02ad8cf953 , < 3e00b1b332e54ba50cca6691f628b9c06574024f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/pinctrl-equilibrium.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "896449ad9053a42c6c710aeae6175170176cabd0",
"status": "affected",
"version": "52066a53bd116a2f41d04d99b5095c02ad8cf953",
"versionType": "git"
},
{
"lessThan": "af3b0ec98dc1133521b612f8009fdd36b612aabe",
"status": "affected",
"version": "52066a53bd116a2f41d04d99b5095c02ad8cf953",
"versionType": "git"
},
{
"lessThan": "53eba152810ef0fff8567b13ea0f62d48e62df6b",
"status": "affected",
"version": "52066a53bd116a2f41d04d99b5095c02ad8cf953",
"versionType": "git"
},
{
"lessThan": "ec54546e8d8a50a9824c139a127a8459d1b0b1bb",
"status": "affected",
"version": "52066a53bd116a2f41d04d99b5095c02ad8cf953",
"versionType": "git"
},
{
"lessThan": "3e00b1b332e54ba50cca6691f628b9c06574024f",
"status": "affected",
"version": "52066a53bd116a2f41d04d99b5095c02ad8cf953",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/pinctrl-equilibrium.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: equilibrium: fix warning trace on load\n\nThe callback functions \u0027eqbr_irq_mask()\u0027 and \u0027eqbr_irq_ack()\u0027 are also\ncalled in the callback function \u0027eqbr_irq_mask_ack()\u0027. This is done to\navoid source code duplication. The problem, is that in the function\n\u0027eqbr_irq_mask()\u0027 also calles the gpiolib function \u0027gpiochip_disable_irq()\u0027\n\nThis generates the following warning trace in the log for every gpio on\nload.\n\n[ 6.088111] ------------[ cut here ]------------\n[ 6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50\n[ 6.097847] Modules linked in:\n[ 6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.59+ #0\n[ 6.097847] Tainted: [W]=WARN\n[ 6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50\n[ 6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 \u003c0f\u003e 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40\n[ 6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046\n[ 6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008\n[ 6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0\n[ 6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000\n[ 6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514\n[ 6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000\n[ 6.097847] FS: 0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000\n[ 6.097847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0\n[ 6.097847] Call Trace:\n[ 6.097847] \u003cTASK\u003e\n[ 6.097847] ? eqbr_irq_mask+0x63/0x70\n[ 6.097847] ? no_action+0x10/0x10\n[ 6.097847] eqbr_irq_mask_ack+0x11/0x60\n\nIn an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the\ninterrupt is not disabled here.\n\nTo fix this, do not call the \u0027eqbr_irq_mask()\u0027 and \u0027eqbr_irq_ack()\u0027\nfunction. Implement instead this directly without disabling the interrupts."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:03.536Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/896449ad9053a42c6c710aeae6175170176cabd0"
},
{
"url": "https://git.kernel.org/stable/c/af3b0ec98dc1133521b612f8009fdd36b612aabe"
},
{
"url": "https://git.kernel.org/stable/c/53eba152810ef0fff8567b13ea0f62d48e62df6b"
},
{
"url": "https://git.kernel.org/stable/c/ec54546e8d8a50a9824c139a127a8459d1b0b1bb"
},
{
"url": "https://git.kernel.org/stable/c/3e00b1b332e54ba50cca6691f628b9c06574024f"
}
],
"title": "pinctrl: equilibrium: fix warning trace on load",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23308",
"datePublished": "2026-03-25T10:27:03.536Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:03.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23348 (GCVE-0-2026-23348)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
cxl: Fix race of nvdimm_bus object when creating nvdimm objects
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl: Fix race of nvdimm_bus object when creating nvdimm objects
Found issue during running of cxl-translate.sh unit test. Adding a 3s
sleep right before the test seems to make the issue reproduce fairly
consistently. The cxl_translate module has dependency on cxl_acpi and
causes orphaned nvdimm objects to reprobe after cxl_acpi is removed.
The nvdimm_bus object is registered by the cxl_nvb object when
cxl_acpi_probe() is called. With the nvdimm_bus object missing,
__nd_device_register() will trigger NULL pointer dereference when
accessing the dev->parent that points to &nvdimm_bus->dev.
[ 192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c
[ 192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025
[ 192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core]
[ 192.899459] RIP: 0010:kobject_get+0xc/0x90
[ 192.924871] Call Trace:
[ 192.925959] <TASK>
[ 192.926976] ? pm_runtime_init+0xb9/0xe0
[ 192.929712] __nd_device_register.part.0+0x4d/0xc0 [libnvdimm]
[ 192.933314] __nvdimm_create+0x206/0x290 [libnvdimm]
[ 192.936662] cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem]
[ 192.940245] cxl_bus_probe+0x1a/0x60 [cxl_core]
[ 192.943349] really_probe+0xde/0x380
This patch also relies on the previous change where
devm_cxl_add_nvdimm_bridge() is called from drivers/cxl/pmem.c instead
of drivers/cxl/core.c to ensure the dependency of cxl_acpi on cxl_pmem.
1. Set probe_type of cxl_nvb to PROBE_FORCE_SYNCHRONOUS to ensure the
driver is probed synchronously when add_device() is called.
2. Add a check in __devm_cxl_add_nvdimm_bridge() to ensure that the
cxl_nvb driver is attached during cxl_acpi_probe().
3. Take the cxl_root uport_dev lock and the cxl_nvb->dev lock in
devm_cxl_add_nvdimm() before checking nvdimm_bus is valid.
4. Set cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so cxl_nvdimm_probe()
will exit with -EBUSY.
The removal of cxl_nvdimm devices should prevent any orphaned devices
from probing once the nvdimm_bus is gone.
[ dj: Fixed 0-day reported kdoc issue. ]
[ dj: Fix cxl_nvb reference leak on error. Gregory (kreview-0811365) ]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
8fdcb1704f61a8fd9be0f3849a174d084def0666 , < 5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7
(git)
Affected: 8fdcb1704f61a8fd9be0f3849a174d084def0666 , < 5b230daeee420833287cc77314439903e5312f10 (git) Affected: 8fdcb1704f61a8fd9be0f3849a174d084def0666 , < 96a1fd0d84b17360840f344826897fa71049870e (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/pmem.c",
"drivers/cxl/cxl.h",
"drivers/cxl/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7",
"status": "affected",
"version": "8fdcb1704f61a8fd9be0f3849a174d084def0666",
"versionType": "git"
},
{
"lessThan": "5b230daeee420833287cc77314439903e5312f10",
"status": "affected",
"version": "8fdcb1704f61a8fd9be0f3849a174d084def0666",
"versionType": "git"
},
{
"lessThan": "96a1fd0d84b17360840f344826897fa71049870e",
"status": "affected",
"version": "8fdcb1704f61a8fd9be0f3849a174d084def0666",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/pmem.c",
"drivers/cxl/cxl.h",
"drivers/cxl/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix race of nvdimm_bus object when creating nvdimm objects\n\nFound issue during running of cxl-translate.sh unit test. Adding a 3s\nsleep right before the test seems to make the issue reproduce fairly\nconsistently. The cxl_translate module has dependency on cxl_acpi and\ncauses orphaned nvdimm objects to reprobe after cxl_acpi is removed.\nThe nvdimm_bus object is registered by the cxl_nvb object when\ncxl_acpi_probe() is called. With the nvdimm_bus object missing,\n__nd_device_register() will trigger NULL pointer dereference when\naccessing the dev-\u003eparent that points to \u0026nvdimm_bus-\u003edev.\n\n[ 192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c\n[ 192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025\n[ 192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core]\n[ 192.899459] RIP: 0010:kobject_get+0xc/0x90\n[ 192.924871] Call Trace:\n[ 192.925959] \u003cTASK\u003e\n[ 192.926976] ? pm_runtime_init+0xb9/0xe0\n[ 192.929712] __nd_device_register.part.0+0x4d/0xc0 [libnvdimm]\n[ 192.933314] __nvdimm_create+0x206/0x290 [libnvdimm]\n[ 192.936662] cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem]\n[ 192.940245] cxl_bus_probe+0x1a/0x60 [cxl_core]\n[ 192.943349] really_probe+0xde/0x380\n\nThis patch also relies on the previous change where\ndevm_cxl_add_nvdimm_bridge() is called from drivers/cxl/pmem.c instead\nof drivers/cxl/core.c to ensure the dependency of cxl_acpi on cxl_pmem.\n\n1. Set probe_type of cxl_nvb to PROBE_FORCE_SYNCHRONOUS to ensure the\n driver is probed synchronously when add_device() is called.\n2. Add a check in __devm_cxl_add_nvdimm_bridge() to ensure that the\n cxl_nvb driver is attached during cxl_acpi_probe().\n3. Take the cxl_root uport_dev lock and the cxl_nvb-\u003edev lock in\n devm_cxl_add_nvdimm() before checking nvdimm_bus is valid.\n4. Set cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so cxl_nvdimm_probe()\n will exit with -EBUSY.\n\nThe removal of cxl_nvdimm devices should prevent any orphaned devices\nfrom probing once the nvdimm_bus is gone.\n\n[ dj: Fixed 0-day reported kdoc issue. ]\n[ dj: Fix cxl_nvb reference leak on error. Gregory (kreview-0811365) ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:34.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7"
},
{
"url": "https://git.kernel.org/stable/c/5b230daeee420833287cc77314439903e5312f10"
},
{
"url": "https://git.kernel.org/stable/c/96a1fd0d84b17360840f344826897fa71049870e"
}
],
"title": "cxl: Fix race of nvdimm_bus object when creating nvdimm objects",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23348",
"datePublished": "2026-03-25T10:27:34.462Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:34.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23293 (GCVE-0-2026-23293)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called
which initializes it. If an IPv6 packet is injected into the interface,
route_shortcircuit() is called and a NULL pointer dereference happens on
neigh_lookup().
BUG: kernel NULL pointer dereference, address: 0000000000000380
Oops: Oops: 0000 [#1] SMP NOPTI
[...]
RIP: 0010:neigh_lookup+0x20/0x270
[...]
Call Trace:
<TASK>
vxlan_xmit+0x638/0x1ef0 [vxlan]
dev_hard_start_xmit+0x9e/0x2e0
__dev_queue_xmit+0xbee/0x14e0
packet_sendmsg+0x116f/0x1930
__sys_sendto+0x1f5/0x200
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x12f/0x1590
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix this by adding an early check on route_shortcircuit() when protocol
is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because
VXLAN can be built-in even when IPv6 is built as a module.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
e15a00aafa4b7953ad717d3cb1ad7acf4ff76945 , < b5190fcd75a1f1785c766a8d1e44d3938e168f45
(git)
Affected: e15a00aafa4b7953ad717d3cb1ad7acf4ff76945 , < 5f93e6b4d12bd3a4517a6d447ea675f448f21434 (git) Affected: e15a00aafa4b7953ad717d3cb1ad7acf4ff76945 , < f0373e9317bc904e7bdb123d3106fe4f3cea2fb7 (git) Affected: e15a00aafa4b7953ad717d3cb1ad7acf4ff76945 , < fbbd2118982c55fb9b0a753ae0cf7194e77149fb (git) Affected: e15a00aafa4b7953ad717d3cb1ad7acf4ff76945 , < abcd48ecdeb2e12eccb8339a35534c757782afcd (git) Affected: e15a00aafa4b7953ad717d3cb1ad7acf4ff76945 , < 168ff39e4758897d2eee4756977d036d52884c7e (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5190fcd75a1f1785c766a8d1e44d3938e168f45",
"status": "affected",
"version": "e15a00aafa4b7953ad717d3cb1ad7acf4ff76945",
"versionType": "git"
},
{
"lessThan": "5f93e6b4d12bd3a4517a6d447ea675f448f21434",
"status": "affected",
"version": "e15a00aafa4b7953ad717d3cb1ad7acf4ff76945",
"versionType": "git"
},
{
"lessThan": "f0373e9317bc904e7bdb123d3106fe4f3cea2fb7",
"status": "affected",
"version": "e15a00aafa4b7953ad717d3cb1ad7acf4ff76945",
"versionType": "git"
},
{
"lessThan": "fbbd2118982c55fb9b0a753ae0cf7194e77149fb",
"status": "affected",
"version": "e15a00aafa4b7953ad717d3cb1ad7acf4ff76945",
"versionType": "git"
},
{
"lessThan": "abcd48ecdeb2e12eccb8339a35534c757782afcd",
"status": "affected",
"version": "e15a00aafa4b7953ad717d3cb1ad7acf4ff76945",
"versionType": "git"
},
{
"lessThan": "168ff39e4758897d2eee4756977d036d52884c7e",
"status": "affected",
"version": "e15a00aafa4b7953ad717d3cb1ad7acf4ff76945",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable=1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If an IPv6 packet is injected into the interface,\nroute_shortcircuit() is called and a NULL pointer dereference happens on\nneigh_lookup().\n\n BUG: kernel NULL pointer dereference, address: 0000000000000380\n Oops: Oops: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x20/0x270\n [...]\n Call Trace:\n \u003cTASK\u003e\n vxlan_xmit+0x638/0x1ef0 [vxlan]\n dev_hard_start_xmit+0x9e/0x2e0\n __dev_queue_xmit+0xbee/0x14e0\n packet_sendmsg+0x116f/0x1930\n __sys_sendto+0x1f5/0x200\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x12f/0x1590\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix this by adding an early check on route_shortcircuit() when protocol\nis ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because\nVXLAN can be built-in even when IPv6 is built as a module."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:51.160Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5190fcd75a1f1785c766a8d1e44d3938e168f45"
},
{
"url": "https://git.kernel.org/stable/c/5f93e6b4d12bd3a4517a6d447ea675f448f21434"
},
{
"url": "https://git.kernel.org/stable/c/f0373e9317bc904e7bdb123d3106fe4f3cea2fb7"
},
{
"url": "https://git.kernel.org/stable/c/fbbd2118982c55fb9b0a753ae0cf7194e77149fb"
},
{
"url": "https://git.kernel.org/stable/c/abcd48ecdeb2e12eccb8339a35534c757782afcd"
},
{
"url": "https://git.kernel.org/stable/c/168ff39e4758897d2eee4756977d036d52884c7e"
}
],
"title": "net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23293",
"datePublished": "2026-03-25T10:26:51.160Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:51.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23360 (GCVE-0-2026-23360)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
nvme: fix admin queue leak on controller reset
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
e8061d02b49c5c901980f58d91e96580e9a14acf , < 64f87b96de0e645a4c066c7cffd753f334446db6
(git)
Affected: 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 , < e159eb852aeee95443a9458ecb7d072bbb689913 (git) Affected: 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 , < 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f (git) Affected: 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 , < b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d (git) Affected: ff037b5f47eeccc1636c03f84cd47db094eb73c9 (git) Affected: a505f0ba36ab24176c300d7ff56aff85c2977e6c (git) Affected: e7dac681790556c131854b97551337aa8042215b (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "64f87b96de0e645a4c066c7cffd753f334446db6",
"status": "affected",
"version": "e8061d02b49c5c901980f58d91e96580e9a14acf",
"versionType": "git"
},
{
"lessThan": "e159eb852aeee95443a9458ecb7d072bbb689913",
"status": "affected",
"version": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
"versionType": "git"
},
{
"lessThan": "8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f",
"status": "affected",
"version": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
"versionType": "git"
},
{
"lessThan": "b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d",
"status": "affected",
"version": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
"versionType": "git"
},
{
"status": "affected",
"version": "ff037b5f47eeccc1636c03f84cd47db094eb73c9",
"versionType": "git"
},
{
"status": "affected",
"version": "a505f0ba36ab24176c300d7ff56aff85c2977e6c",
"versionType": "git"
},
{
"status": "affected",
"version": "e7dac681790556c131854b97551337aa8042215b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.12.62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin queue leak on controller reset\n\nWhen nvme_alloc_admin_tag_set() is called during a controller reset,\na previous admin queue may still exist. Release it properly before\nallocating a new one to avoid orphaning the old queue.\n\nThis fixes a regression introduced by commit 03b3bcd319b3 (\"nvme: fix\nadmin request_queue lifetime\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:43.892Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/64f87b96de0e645a4c066c7cffd753f334446db6"
},
{
"url": "https://git.kernel.org/stable/c/e159eb852aeee95443a9458ecb7d072bbb689913"
},
{
"url": "https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f"
},
{
"url": "https://git.kernel.org/stable/c/b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d"
}
],
"title": "nvme: fix admin queue leak on controller reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23360",
"datePublished": "2026-03-25T10:27:43.892Z",
"dateReserved": "2026-01-13T15:37:46.001Z",
"dateUpdated": "2026-03-25T10:27:43.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23297 (GCVE-0-2026-23297)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
syzbot reported memory leak of struct cred. [0]
nfsd_nl_threads_set_doit() passes get_current_cred() to
nfsd_svc(), but put_cred() is not called after that.
The cred is finally passed down to _svc_xprt_create(),
which calls get_cred() with the cred for struct svc_xprt.
The ownership of the refcount by get_current_cred() is not
transferred to anywhere and is just leaked.
nfsd_svc() is also called from write_threads(), but it does
not bump file->f_cred there.
nfsd_nl_threads_set_doit() is called from sendmsg() and
current->cred does not go away.
Let's use current_cred() in nfsd_nl_threads_set_doit().
[0]:
BUG: memory leak
unreferenced object 0xffff888108b89480 (size 184):
comm "syz-executor", pid 5994, jiffies 4294943386
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 369454a7):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270
prepare_creds+0x22/0x600 kernel/cred.c:185
copy_creds+0x44/0x290 kernel/cred.c:286
copy_process+0x7a7/0x2870 kernel/fork.c:2086
kernel_clone+0xac/0x6e0 kernel/fork.c:2651
__do_sys_clone+0x7f/0xb0 kernel/fork.c:2792
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
924f4fb003ba114c60b3c07a011dcd86a8956cd1 , < 41170716421c25cd20b39e83f0e0762e212b377b
(git)
Affected: 924f4fb003ba114c60b3c07a011dcd86a8956cd1 , < 27c13c5bb0948e3b5c64e59f8a903231896fab9b (git) Affected: 924f4fb003ba114c60b3c07a011dcd86a8956cd1 , < a3f88e3e18b51a7f654189189c762ebcdeaa7e29 (git) Affected: 924f4fb003ba114c60b3c07a011dcd86a8956cd1 , < 1cb968a2013ffa8112d52ebe605009ea1c6a582c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfsctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41170716421c25cd20b39e83f0e0762e212b377b",
"status": "affected",
"version": "924f4fb003ba114c60b3c07a011dcd86a8956cd1",
"versionType": "git"
},
{
"lessThan": "27c13c5bb0948e3b5c64e59f8a903231896fab9b",
"status": "affected",
"version": "924f4fb003ba114c60b3c07a011dcd86a8956cd1",
"versionType": "git"
},
{
"lessThan": "a3f88e3e18b51a7f654189189c762ebcdeaa7e29",
"status": "affected",
"version": "924f4fb003ba114c60b3c07a011dcd86a8956cd1",
"versionType": "git"
},
{
"lessThan": "1cb968a2013ffa8112d52ebe605009ea1c6a582c",
"status": "affected",
"version": "924f4fb003ba114c60b3c07a011dcd86a8956cd1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfsctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().\n\nsyzbot reported memory leak of struct cred. [0]\n\nnfsd_nl_threads_set_doit() passes get_current_cred() to\nnfsd_svc(), but put_cred() is not called after that.\n\nThe cred is finally passed down to _svc_xprt_create(),\nwhich calls get_cred() with the cred for struct svc_xprt.\n\nThe ownership of the refcount by get_current_cred() is not\ntransferred to anywhere and is just leaked.\n\nnfsd_svc() is also called from write_threads(), but it does\nnot bump file-\u003ef_cred there.\n\nnfsd_nl_threads_set_doit() is called from sendmsg() and\ncurrent-\u003ecred does not go away.\n\nLet\u0027s use current_cred() in nfsd_nl_threads_set_doit().\n\n[0]:\nBUG: memory leak\nunreferenced object 0xffff888108b89480 (size 184):\n comm \"syz-executor\", pid 5994, jiffies 4294943386\n hex dump (first 32 bytes):\n 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace (crc 369454a7):\n kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n slab_post_alloc_hook mm/slub.c:4958 [inline]\n slab_alloc_node mm/slub.c:5263 [inline]\n kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270\n prepare_creds+0x22/0x600 kernel/cred.c:185\n copy_creds+0x44/0x290 kernel/cred.c:286\n copy_process+0x7a7/0x2870 kernel/fork.c:2086\n kernel_clone+0xac/0x6e0 kernel/fork.c:2651\n __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:54.156Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41170716421c25cd20b39e83f0e0762e212b377b"
},
{
"url": "https://git.kernel.org/stable/c/27c13c5bb0948e3b5c64e59f8a903231896fab9b"
},
{
"url": "https://git.kernel.org/stable/c/a3f88e3e18b51a7f654189189c762ebcdeaa7e29"
},
{
"url": "https://git.kernel.org/stable/c/1cb968a2013ffa8112d52ebe605009ea1c6a582c"
}
],
"title": "nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23297",
"datePublished": "2026-03-25T10:26:54.156Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:54.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23374 (GCVE-0-2026-23374)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
blktrace: fix __this_cpu_read/write in preemptible context
Summary
In the Linux kernel, the following vulnerability has been resolved:
blktrace: fix __this_cpu_read/write in preemptible context
tracing_record_cmdline() internally uses __this_cpu_read() and
__this_cpu_write() on the per-CPU variable trace_cmdline_save, and
trace_save_cmdline() explicitly asserts preemption is disabled via
lockdep_assert_preemption_disabled(). These operations are only safe
when preemption is off, as they were designed to be called from the
scheduler context (probe_wakeup_sched_switch() / probe_wakeup()).
__blk_add_trace() was calling tracing_record_cmdline(current) early in
the blk_tracer path, before ring buffer reservation, from process
context where preemption is fully enabled. This triggers the following
using blktests/blktrace/002:
blktrace/002 (blktrace ftrace corruption with sysfs trace) [failed]
runtime 0.367s ... 0.437s
something found in dmesg:
[ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33
[ 81.239580] null_blk: disk nullb1 created
[ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516
[ 81.362842] caller is tracing_record_cmdline+0x10/0x40
[ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)
[ 81.362877] Tainted: [N]=TEST
[ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 81.362881] Call Trace:
[ 81.362884] <TASK>
[ 81.362886] dump_stack_lvl+0x8d/0xb0
...
(See '/mnt/sda/blktests/results/nodev/blktrace/002.dmesg' for the entire message)
[ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33
[ 81.239580] null_blk: disk nullb1 created
[ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516
[ 81.362842] caller is tracing_record_cmdline+0x10/0x40
[ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)
[ 81.362877] Tainted: [N]=TEST
[ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 81.362881] Call Trace:
[ 81.362884] <TASK>
[ 81.362886] dump_stack_lvl+0x8d/0xb0
[ 81.362895] check_preemption_disabled+0xce/0xe0
[ 81.362902] tracing_record_cmdline+0x10/0x40
[ 81.362923] __blk_add_trace+0x307/0x5d0
[ 81.362934] ? lock_acquire+0xe0/0x300
[ 81.362940] ? iov_iter_extract_pages+0x101/0xa30
[ 81.362959] blk_add_trace_bio+0x106/0x1e0
[ 81.362968] submit_bio_noacct_nocheck+0x24b/0x3a0
[ 81.362979] ? lockdep_init_map_type+0x58/0x260
[ 81.362988] submit_bio_wait+0x56/0x90
[ 81.363009] __blkdev_direct_IO_simple+0x16c/0x250
[ 81.363026] ? __pfx_submit_bio_wait_endio+0x10/0x10
[ 81.363038] ? rcu_read_lock_any_held+0x73/0xa0
[ 81.363051] blkdev_read_iter+0xc1/0x140
[ 81.363059] vfs_read+0x20b/0x330
[ 81.363083] ksys_read+0x67/0xe0
[ 81.363090] do_syscall_64+0xbf/0xf00
[ 81.363102] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 81.363106] RIP: 0033:0x7f281906029d
[ 81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec
[ 81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d
[ 81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000
[ 81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000
[ 81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000
[ 81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a
[ 81.363142] </TASK>
The same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(),
and blk_add_trace_rq() paths as well.
The purpose of tracin
---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/blktrace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59efa088752b1c380a0475974679850cc8aef907",
"status": "affected",
"version": "7ffbd48d5cab22bcd1120eb2349db1319e2d827a",
"versionType": "git"
},
{
"lessThan": "da46b5dfef48658d03347cda21532bcdbb521e67",
"status": "affected",
"version": "7ffbd48d5cab22bcd1120eb2349db1319e2d827a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/blktrace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: fix __this_cpu_read/write in preemptible context\n\ntracing_record_cmdline() internally uses __this_cpu_read() and\n__this_cpu_write() on the per-CPU variable trace_cmdline_save, and\ntrace_save_cmdline() explicitly asserts preemption is disabled via\nlockdep_assert_preemption_disabled(). These operations are only safe\nwhen preemption is off, as they were designed to be called from the\nscheduler context (probe_wakeup_sched_switch() / probe_wakeup()).\n\n__blk_add_trace() was calling tracing_record_cmdline(current) early in\nthe blk_tracer path, before ring buffer reservation, from process\ncontext where preemption is fully enabled. This triggers the following\nusing blktests/blktrace/002:\n\nblktrace/002 (blktrace ftrace corruption with sysfs trace) [failed]\n runtime 0.367s ... 0.437s\n something found in dmesg:\n [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n [ 81.239580] null_blk: disk nullb1 created\n [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n [ 81.362842] caller is tracing_record_cmdline+0x10/0x40\n [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)\n [ 81.362877] Tainted: [N]=TEST\n [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n [ 81.362881] Call Trace:\n [ 81.362884] \u003cTASK\u003e\n [ 81.362886] dump_stack_lvl+0x8d/0xb0\n ...\n (See \u0027/mnt/sda/blktests/results/nodev/blktrace/002.dmesg\u0027 for the entire message)\n\n[ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n[ 81.239580] null_blk: disk nullb1 created\n[ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n[ 81.362842] caller is tracing_record_cmdline+0x10/0x40\n[ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full)\n[ 81.362877] Tainted: [N]=TEST\n[ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[ 81.362881] Call Trace:\n[ 81.362884] \u003cTASK\u003e\n[ 81.362886] dump_stack_lvl+0x8d/0xb0\n[ 81.362895] check_preemption_disabled+0xce/0xe0\n[ 81.362902] tracing_record_cmdline+0x10/0x40\n[ 81.362923] __blk_add_trace+0x307/0x5d0\n[ 81.362934] ? lock_acquire+0xe0/0x300\n[ 81.362940] ? iov_iter_extract_pages+0x101/0xa30\n[ 81.362959] blk_add_trace_bio+0x106/0x1e0\n[ 81.362968] submit_bio_noacct_nocheck+0x24b/0x3a0\n[ 81.362979] ? lockdep_init_map_type+0x58/0x260\n[ 81.362988] submit_bio_wait+0x56/0x90\n[ 81.363009] __blkdev_direct_IO_simple+0x16c/0x250\n[ 81.363026] ? __pfx_submit_bio_wait_endio+0x10/0x10\n[ 81.363038] ? rcu_read_lock_any_held+0x73/0xa0\n[ 81.363051] blkdev_read_iter+0xc1/0x140\n[ 81.363059] vfs_read+0x20b/0x330\n[ 81.363083] ksys_read+0x67/0xe0\n[ 81.363090] do_syscall_64+0xbf/0xf00\n[ 81.363102] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 81.363106] RIP: 0033:0x7f281906029d\n[ 81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec\n[ 81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[ 81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d\n[ 81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000\n[ 81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000\n[ 81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000\n[ 81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a\n[ 81.363142] \u003c/TASK\u003e\n\nThe same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(),\nand blk_add_trace_rq() paths as well.\n\nThe purpose of tracin\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:55.117Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59efa088752b1c380a0475974679850cc8aef907"
},
{
"url": "https://git.kernel.org/stable/c/da46b5dfef48658d03347cda21532bcdbb521e67"
}
],
"title": "blktrace: fix __this_cpu_read/write in preemptible context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23374",
"datePublished": "2026-03-25T10:27:55.117Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:55.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23349 (GCVE-0-2026-23349)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
HID: pidff: Fix condition effect bit clearing
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: pidff: Fix condition effect bit clearing
As reported by MPDarkGuy on discord, NULL pointer dereferences were
happening because not all the conditional effects bits were cleared.
Properly clear all conditional effect bits from ffbit
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e , < d1edc027a4b0bb4c7a2670b530590b4df6177011
(git)
Affected: 7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e , < ef0e669dbceaf3d7bb4ae0b235fa61feabd92b0b (git) Affected: 7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e , < 97d5c8f5c09a604c4873c8348f58de3cea69a7df (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/usbhid/hid-pidff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1edc027a4b0bb4c7a2670b530590b4df6177011",
"status": "affected",
"version": "7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e",
"versionType": "git"
},
{
"lessThan": "ef0e669dbceaf3d7bb4ae0b235fa61feabd92b0b",
"status": "affected",
"version": "7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e",
"versionType": "git"
},
{
"lessThan": "97d5c8f5c09a604c4873c8348f58de3cea69a7df",
"status": "affected",
"version": "7f3d7bc0df4bdc23d31cf0f90b6e20c45129465e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/usbhid/hid-pidff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: pidff: Fix condition effect bit clearing\n\nAs reported by MPDarkGuy on discord, NULL pointer dereferences were\nhappening because not all the conditional effects bits were cleared.\n\nProperly clear all conditional effect bits from ffbit"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:35.443Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1edc027a4b0bb4c7a2670b530590b4df6177011"
},
{
"url": "https://git.kernel.org/stable/c/ef0e669dbceaf3d7bb4ae0b235fa61feabd92b0b"
},
{
"url": "https://git.kernel.org/stable/c/97d5c8f5c09a604c4873c8348f58de3cea69a7df"
}
],
"title": "HID: pidff: Fix condition effect bit clearing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23349",
"datePublished": "2026-03-25T10:27:35.443Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:35.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23291 (GCVE-0-2026-23291)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
nfc: pn533: properly drop the usb interface reference on disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: properly drop the usb interface reference on disconnect
When the device is disconnected from the driver, there is a "dangling"
reference count on the usb interface that was grabbed in the probe
callback. Fix this up by properly dropping the reference after we are
done with it.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
c46ee38620a2aa2b25b16bc9738ace80dbff76a4 , < 7398d6570501edc55a50ece820f369ab3c1df2e7
(git)
Affected: c46ee38620a2aa2b25b16bc9738ace80dbff76a4 , < d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0 (git) Affected: c46ee38620a2aa2b25b16bc9738ace80dbff76a4 , < 7ff14eb070f0efecb2606f8d7aa01b77d188e886 (git) Affected: c46ee38620a2aa2b25b16bc9738ace80dbff76a4 , < 00477cab053dc4816b99141d8fcca7a479cfebeb (git) Affected: c46ee38620a2aa2b25b16bc9738ace80dbff76a4 , < 4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74 (git) Affected: c46ee38620a2aa2b25b16bc9738ace80dbff76a4 , < 12133a483dfa832241fbbf09321109a0ea8a520e (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nfc/pn533/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7398d6570501edc55a50ece820f369ab3c1df2e7",
"status": "affected",
"version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4",
"versionType": "git"
},
{
"lessThan": "d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0",
"status": "affected",
"version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4",
"versionType": "git"
},
{
"lessThan": "7ff14eb070f0efecb2606f8d7aa01b77d188e886",
"status": "affected",
"version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4",
"versionType": "git"
},
{
"lessThan": "00477cab053dc4816b99141d8fcca7a479cfebeb",
"status": "affected",
"version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4",
"versionType": "git"
},
{
"lessThan": "4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74",
"status": "affected",
"version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4",
"versionType": "git"
},
{
"lessThan": "12133a483dfa832241fbbf09321109a0ea8a520e",
"status": "affected",
"version": "c46ee38620a2aa2b25b16bc9738ace80dbff76a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nfc/pn533/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: properly drop the usb interface reference on disconnect\n\nWhen the device is disconnected from the driver, there is a \"dangling\"\nreference count on the usb interface that was grabbed in the probe\ncallback. Fix this up by properly dropping the reference after we are\ndone with it."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:49.634Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7398d6570501edc55a50ece820f369ab3c1df2e7"
},
{
"url": "https://git.kernel.org/stable/c/d1f6d20b3c2642ec85ce6ea5da7155746c31c6d0"
},
{
"url": "https://git.kernel.org/stable/c/7ff14eb070f0efecb2606f8d7aa01b77d188e886"
},
{
"url": "https://git.kernel.org/stable/c/00477cab053dc4816b99141d8fcca7a479cfebeb"
},
{
"url": "https://git.kernel.org/stable/c/4551d6cea00224ab65a0ef35e4e6da0e9c0a2d74"
},
{
"url": "https://git.kernel.org/stable/c/12133a483dfa832241fbbf09321109a0ea8a520e"
}
],
"title": "nfc: pn533: properly drop the usb interface reference on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23291",
"datePublished": "2026-03-25T10:26:49.634Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:49.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23383 (GCVE-0-2026-23383)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
struct bpf_plt contains a u64 target field. Currently, the BPF JIT
allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT
buffer.
Because the base address of the JIT buffer can be 4-byte aligned (e.g.,
ending in 0x4 or 0xc), the relative padding logic in build_plt() fails
to ensure that target lands on an 8-byte boundary.
This leads to two issues:
1. UBSAN reports misaligned-access warnings when dereferencing the
structure.
2. More critically, target is updated concurrently via WRITE_ONCE() in
bpf_arch_text_poke() while the JIT'd code executes ldr. On arm64,
64-bit loads/stores are only guaranteed to be single-copy atomic if
they are 64-bit aligned. A misaligned target risks a torn read,
causing the JIT to jump to a corrupted address.
Fix this by increasing the allocation alignment requirement to 8 bytes
(sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of
the JIT buffer to an 8-byte boundary, allowing the relative padding math
in build_plt() to correctly align the target field.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
b2ad54e1533e91449cb2a371e034942bd7882b58 , < 80ad264da02cc4aee718e799c2b79f0f834673dc
(git)
Affected: b2ad54e1533e91449cb2a371e034942bd7882b58 , < 519b1ad91de5bf7a496f2b858e9212db6328e1de (git) Affected: b2ad54e1533e91449cb2a371e034942bd7882b58 , < 66959ed481a474eaae278c7f6860a2a9b188a4d6 (git) Affected: b2ad54e1533e91449cb2a371e034942bd7882b58 , < ef06fd16d48704eac868441d98d4ef083d8f3d07 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "80ad264da02cc4aee718e799c2b79f0f834673dc",
"status": "affected",
"version": "b2ad54e1533e91449cb2a371e034942bd7882b58",
"versionType": "git"
},
{
"lessThan": "519b1ad91de5bf7a496f2b858e9212db6328e1de",
"status": "affected",
"version": "b2ad54e1533e91449cb2a371e034942bd7882b58",
"versionType": "git"
},
{
"lessThan": "66959ed481a474eaae278c7f6860a2a9b188a4d6",
"status": "affected",
"version": "b2ad54e1533e91449cb2a371e034942bd7882b58",
"versionType": "git"
},
{
"lessThan": "ef06fd16d48704eac868441d98d4ef083d8f3d07",
"status": "affected",
"version": "b2ad54e1533e91449cb2a371e034942bd7882b58",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing\n\nstruct bpf_plt contains a u64 target field. Currently, the BPF JIT\nallocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT\nbuffer.\n\nBecause the base address of the JIT buffer can be 4-byte aligned (e.g.,\nending in 0x4 or 0xc), the relative padding logic in build_plt() fails\nto ensure that target lands on an 8-byte boundary.\n\nThis leads to two issues:\n1. UBSAN reports misaligned-access warnings when dereferencing the\n structure.\n2. More critically, target is updated concurrently via WRITE_ONCE() in\n bpf_arch_text_poke() while the JIT\u0027d code executes ldr. On arm64,\n 64-bit loads/stores are only guaranteed to be single-copy atomic if\n they are 64-bit aligned. A misaligned target risks a torn read,\n causing the JIT to jump to a corrupted address.\n\nFix this by increasing the allocation alignment requirement to 8 bytes\n(sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of\nthe JIT buffer to an 8-byte boundary, allowing the relative padding math\nin build_plt() to correctly align the target field."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:02.126Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/80ad264da02cc4aee718e799c2b79f0f834673dc"
},
{
"url": "https://git.kernel.org/stable/c/519b1ad91de5bf7a496f2b858e9212db6328e1de"
},
{
"url": "https://git.kernel.org/stable/c/66959ed481a474eaae278c7f6860a2a9b188a4d6"
},
{
"url": "https://git.kernel.org/stable/c/ef06fd16d48704eac868441d98d4ef083d8f3d07"
}
],
"title": "bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23383",
"datePublished": "2026-03-25T10:28:02.126Z",
"dateReserved": "2026-01-13T15:37:46.007Z",
"dateUpdated": "2026-03-25T10:28:02.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23303 (GCVE-0-2026-23303)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
When debug logging is enabled, cifs_set_cifscreds() logs the key
payload and exposes the plaintext username and password. Remove the
debug log to avoid exposing credentials.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < ff0ece8ed04180c52167c003362284b23cf54e8d
(git)
Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 3990f352bb0adc8688d0949a9c13e3110570eb61 (git) Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < b746a357abfb8fdb0a171d51ec5091e786d34be1 (git) Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1 (git) Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 3e182701db612ddd794ccd5ed822e6cc1db2b972 (git) Affected: 8a8798a5ff90977d6459ce1d657cf8fe13a51e97 , < 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff0ece8ed04180c52167c003362284b23cf54e8d",
"status": "affected",
"version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
"versionType": "git"
},
{
"lessThan": "3990f352bb0adc8688d0949a9c13e3110570eb61",
"status": "affected",
"version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
"versionType": "git"
},
{
"lessThan": "b746a357abfb8fdb0a171d51ec5091e786d34be1",
"status": "affected",
"version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
"versionType": "git"
},
{
"lessThan": "2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1",
"status": "affected",
"version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
"versionType": "git"
},
{
"lessThan": "3e182701db612ddd794ccd5ed822e6cc1db2b972",
"status": "affected",
"version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
"versionType": "git"
},
{
"lessThan": "2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d",
"status": "affected",
"version": "8a8798a5ff90977d6459ce1d657cf8fe13a51e97",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Don\u0027t log plaintext credentials in cifs_set_cifscreds\n\nWhen debug logging is enabled, cifs_set_cifscreds() logs the key\npayload and exposes the plaintext username and password. Remove the\ndebug log to avoid exposing credentials."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:58.166Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff0ece8ed04180c52167c003362284b23cf54e8d"
},
{
"url": "https://git.kernel.org/stable/c/3990f352bb0adc8688d0949a9c13e3110570eb61"
},
{
"url": "https://git.kernel.org/stable/c/b746a357abfb8fdb0a171d51ec5091e786d34be1"
},
{
"url": "https://git.kernel.org/stable/c/2ef0fc3bf49db2b9df36d5f44508c9e384bfa2a1"
},
{
"url": "https://git.kernel.org/stable/c/3e182701db612ddd794ccd5ed822e6cc1db2b972"
},
{
"url": "https://git.kernel.org/stable/c/2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d"
}
],
"title": "smb: client: Don\u0027t log plaintext credentials in cifs_set_cifscreds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23303",
"datePublished": "2026-03-25T10:26:58.166Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:58.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23298 (GCVE-0-2026-23298)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
can: ucan: Fix infinite loop from zero-length messages
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: ucan: Fix infinite loop from zero-length messages
If a broken ucan device gets a message with the message length field set
to 0, then the driver will loop for forever in
ucan_read_bulk_callback(), hanging the system. If the length is 0, just
skip the message and go on to the next one.
This has been fixed in the kvaser_usb driver in the past in commit
0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in
command parsers"), so there must be some broken devices out there like
this somewhere.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
9f2d3eae88d26c29d96e42983b755940d9169cd9 , < ab6f075492d37368b4c7b0df7f7fdc2b666887fc
(git)
Affected: 9f2d3eae88d26c29d96e42983b755940d9169cd9 , < 13b646eec3ba1131180803f5aaf1fee23540ad8f (git) Affected: 9f2d3eae88d26c29d96e42983b755940d9169cd9 , < bd85f21a6219aeae4389d700c54f1799f4b814e0 (git) Affected: 9f2d3eae88d26c29d96e42983b755940d9169cd9 , < aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588 (git) Affected: 9f2d3eae88d26c29d96e42983b755940d9169cd9 , < c7bc62be6c1a60bb21301692009590b1ffda91d9 (git) Affected: 9f2d3eae88d26c29d96e42983b755940d9169cd9 , < 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ucan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ab6f075492d37368b4c7b0df7f7fdc2b666887fc",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "13b646eec3ba1131180803f5aaf1fee23540ad8f",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "bd85f21a6219aeae4389d700c54f1799f4b814e0",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "c7bc62be6c1a60bb21301692009590b1ffda91d9",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "1e446fd0582ad8be9f6dafb115fc2e7245f9bea7",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ucan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: Fix infinite loop from zero-length messages\n\nIf a broken ucan device gets a message with the message length field set\nto 0, then the driver will loop for forever in\nucan_read_bulk_callback(), hanging the system. If the length is 0, just\nskip the message and go on to the next one.\n\nThis has been fixed in the kvaser_usb driver in the past in commit\n0c73772cd2b8 (\"can: kvaser_usb: leaf: Fix potential infinite loop in\ncommand parsers\"), so there must be some broken devices out there like\nthis somewhere."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:54.830Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ab6f075492d37368b4c7b0df7f7fdc2b666887fc"
},
{
"url": "https://git.kernel.org/stable/c/13b646eec3ba1131180803f5aaf1fee23540ad8f"
},
{
"url": "https://git.kernel.org/stable/c/bd85f21a6219aeae4389d700c54f1799f4b814e0"
},
{
"url": "https://git.kernel.org/stable/c/aa9e0a7fe5efc2f74327fd37d828e9a51d9ff588"
},
{
"url": "https://git.kernel.org/stable/c/c7bc62be6c1a60bb21301692009590b1ffda91d9"
},
{
"url": "https://git.kernel.org/stable/c/1e446fd0582ad8be9f6dafb115fc2e7245f9bea7"
}
],
"title": "can: ucan: Fix infinite loop from zero-length messages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23298",
"datePublished": "2026-03-25T10:26:54.830Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:54.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23325 (GCVE-0-2026-23325)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
Check frame length before accessing the mgmt fields in
mt7996_mac_write_txwi_80211 in order to avoid a possible oob access.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
98686cd21624c75a043e96812beadddf4f6f48e5 , < a6605f61913155e130bfd04d438c3ce1a572fb0f
(git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < ca1adc04fc2cb1d9f1842e429debe6a520d54966 (git) Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < f4cdf6b43689e901a341e7147fcfb25057c38eae (git) Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 45661d22639c4b747ef1bd0822b8e76e421a808a (git) Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 60862846308627e9e15546bb647a00de44deb27b (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6605f61913155e130bfd04d438c3ce1a572fb0f",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "ca1adc04fc2cb1d9f1842e429debe6a520d54966",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "f4cdf6b43689e901a341e7147fcfb25057c38eae",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "45661d22639c4b747ef1bd0822b8e76e421a808a",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "60862846308627e9e15546bb647a00de44deb27b",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt7996_mac_write_txwi_80211 in order to avoid a possible oob access."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:18.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6605f61913155e130bfd04d438c3ce1a572fb0f"
},
{
"url": "https://git.kernel.org/stable/c/ca1adc04fc2cb1d9f1842e429debe6a520d54966"
},
{
"url": "https://git.kernel.org/stable/c/f4cdf6b43689e901a341e7147fcfb25057c38eae"
},
{
"url": "https://git.kernel.org/stable/c/45661d22639c4b747ef1bd0822b8e76e421a808a"
},
{
"url": "https://git.kernel.org/stable/c/60862846308627e9e15546bb647a00de44deb27b"
}
],
"title": "wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23325",
"datePublished": "2026-03-25T10:27:18.204Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:18.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23324 (GCVE-0-2026-23324)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
When submitting an urb, that is using the anchor pattern, it needs to be
anchored before submitting it otherwise it could be leaked if
usb_kill_anchored_urbs() is called. This logic is correctly done
elsewhere in the driver, except in the read bulk callback so do that
here also.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8537257874e949a59c834cecfd5a063e11b64b0b , < 2185ea6e4ebcb61d1224dc7d187c59723cb5ad59
(git)
Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < f6e90c113c92e83fc0963d5e60e16b0e8a268981 (git) Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < b878444519fa03a3edd287d1963cf79ef78be2f1 (git) Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < 18eee279e9b5bff0db1aca9475ae4bc12804f05c (git) Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < b8f9ca88253574638bcff38900a4c28d570b1919 (git) Affected: 8537257874e949a59c834cecfd5a063e11b64b0b , < 5eaad4f768266f1f17e01232ffe2ef009f8129b7 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/etas_es58x/es58x_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2185ea6e4ebcb61d1224dc7d187c59723cb5ad59",
"status": "affected",
"version": "8537257874e949a59c834cecfd5a063e11b64b0b",
"versionType": "git"
},
{
"lessThan": "f6e90c113c92e83fc0963d5e60e16b0e8a268981",
"status": "affected",
"version": "8537257874e949a59c834cecfd5a063e11b64b0b",
"versionType": "git"
},
{
"lessThan": "b878444519fa03a3edd287d1963cf79ef78be2f1",
"status": "affected",
"version": "8537257874e949a59c834cecfd5a063e11b64b0b",
"versionType": "git"
},
{
"lessThan": "18eee279e9b5bff0db1aca9475ae4bc12804f05c",
"status": "affected",
"version": "8537257874e949a59c834cecfd5a063e11b64b0b",
"versionType": "git"
},
{
"lessThan": "b8f9ca88253574638bcff38900a4c28d570b1919",
"status": "affected",
"version": "8537257874e949a59c834cecfd5a063e11b64b0b",
"versionType": "git"
},
{
"lessThan": "5eaad4f768266f1f17e01232ffe2ef009f8129b7",
"status": "affected",
"version": "8537257874e949a59c834cecfd5a063e11b64b0b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/etas_es58x/es58x_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: usb: etas_es58x: correctly anchor the urb in the read bulk callback\n\nWhen submitting an urb, that is using the anchor pattern, it needs to be\nanchored before submitting it otherwise it could be leaked if\nusb_kill_anchored_urbs() is called. This logic is correctly done\nelsewhere in the driver, except in the read bulk callback so do that\nhere also."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:17.476Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2185ea6e4ebcb61d1224dc7d187c59723cb5ad59"
},
{
"url": "https://git.kernel.org/stable/c/f6e90c113c92e83fc0963d5e60e16b0e8a268981"
},
{
"url": "https://git.kernel.org/stable/c/b878444519fa03a3edd287d1963cf79ef78be2f1"
},
{
"url": "https://git.kernel.org/stable/c/18eee279e9b5bff0db1aca9475ae4bc12804f05c"
},
{
"url": "https://git.kernel.org/stable/c/b8f9ca88253574638bcff38900a4c28d570b1919"
},
{
"url": "https://git.kernel.org/stable/c/5eaad4f768266f1f17e01232ffe2ef009f8129b7"
}
],
"title": "can: usb: etas_es58x: correctly anchor the urb in the read bulk callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23324",
"datePublished": "2026-03-25T10:27:17.476Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:17.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23329 (GCVE-0-2026-23329)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
libie: don't unroll if fwlog isn't supported
Summary
In the Linux kernel, the following vulnerability has been resolved:
libie: don't unroll if fwlog isn't supported
The libie_fwlog_deinit() function can be called during driver unload
even when firmware logging was never properly initialized. This led to call
trace:
[ 148.576156] Oops: Oops: 0000 [#1] SMP NOPTI
[ 148.576167] CPU: 80 UID: 0 PID: 12843 Comm: rmmod Kdump: loaded Not tainted 6.17.0-rc7next-queue-3oct-01915-g06d79d51cf51 #1 PREEMPT(full)
[ 148.576177] Hardware name: HPE ProLiant DL385 Gen10 Plus/ProLiant DL385 Gen10 Plus, BIOS A42 07/18/2020
[ 148.576182] RIP: 0010:__dev_printk+0x16/0x70
[ 148.576196] Code: 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 55 41 54 49 89 d4 55 48 89 fd 53 48 85 f6 74 3c <4c> 8b 6e 50 48 89 f3 4d 85 ed 75 03 4c 8b 2e 48 89 df e8 f3 27 98
[ 148.576204] RSP: 0018:ffffd2fd7ea17a48 EFLAGS: 00010202
[ 148.576211] RAX: ffffd2fd7ea17aa0 RBX: ffff8eb288ae2000 RCX: 0000000000000000
[ 148.576217] RDX: ffffd2fd7ea17a70 RSI: 00000000000000c8 RDI: ffffffffb68d3d88
[ 148.576222] RBP: ffffffffb68d3d88 R08: 0000000000000000 R09: 0000000000000000
[ 148.576227] R10: 00000000000000c8 R11: ffff8eb2b1a49400 R12: ffffd2fd7ea17a70
[ 148.576231] R13: ffff8eb3141fb000 R14: ffffffffc1215b48 R15: ffffffffc1215bd8
[ 148.576236] FS: 00007f5666ba6740(0000) GS:ffff8eb2472b9000(0000) knlGS:0000000000000000
[ 148.576242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 148.576247] CR2: 0000000000000118 CR3: 000000011ad17000 CR4: 0000000000350ef0
[ 148.576252] Call Trace:
[ 148.576258] <TASK>
[ 148.576269] _dev_warn+0x7c/0x96
[ 148.576290] libie_fwlog_deinit+0x112/0x117 [libie_fwlog]
[ 148.576303] ixgbe_remove+0x63/0x290 [ixgbe]
[ 148.576342] pci_device_remove+0x42/0xb0
[ 148.576354] device_release_driver_internal+0x19c/0x200
[ 148.576365] driver_detach+0x48/0x90
[ 148.576372] bus_remove_driver+0x6d/0xf0
[ 148.576383] pci_unregister_driver+0x2e/0xb0
[ 148.576393] ixgbe_exit_module+0x1c/0xd50 [ixgbe]
[ 148.576430] __do_sys_delete_module.isra.0+0x1bc/0x2e0
[ 148.576446] do_syscall_64+0x7f/0x980
It can be reproduced by trying to unload ixgbe driver in recovery mode.
Fix that by checking if fwlog is supported before doing unroll.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
641585bc978e0a1170ca8f12fbb1468b3874a2db , < 0138d1cdb19fa49181a5aaba32427f1787cb3935
(git)
Affected: 641585bc978e0a1170ca8f12fbb1468b3874a2db , < 460c56ecbef57684aad1d6af525b89dcd3565701 (git) Affected: 641585bc978e0a1170ca8f12fbb1468b3874a2db , < 636cc3bd12f499c74eaf5dc9a7d5b832f1bb24ed (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/libie/fwlog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0138d1cdb19fa49181a5aaba32427f1787cb3935",
"status": "affected",
"version": "641585bc978e0a1170ca8f12fbb1468b3874a2db",
"versionType": "git"
},
{
"lessThan": "460c56ecbef57684aad1d6af525b89dcd3565701",
"status": "affected",
"version": "641585bc978e0a1170ca8f12fbb1468b3874a2db",
"versionType": "git"
},
{
"lessThan": "636cc3bd12f499c74eaf5dc9a7d5b832f1bb24ed",
"status": "affected",
"version": "641585bc978e0a1170ca8f12fbb1468b3874a2db",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/libie/fwlog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibie: don\u0027t unroll if fwlog isn\u0027t supported\n\nThe libie_fwlog_deinit() function can be called during driver unload\neven when firmware logging was never properly initialized. This led to call\ntrace:\n\n[ 148.576156] Oops: Oops: 0000 [#1] SMP NOPTI\n[ 148.576167] CPU: 80 UID: 0 PID: 12843 Comm: rmmod Kdump: loaded Not tainted 6.17.0-rc7next-queue-3oct-01915-g06d79d51cf51 #1 PREEMPT(full)\n[ 148.576177] Hardware name: HPE ProLiant DL385 Gen10 Plus/ProLiant DL385 Gen10 Plus, BIOS A42 07/18/2020\n[ 148.576182] RIP: 0010:__dev_printk+0x16/0x70\n[ 148.576196] Code: 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 55 41 54 49 89 d4 55 48 89 fd 53 48 85 f6 74 3c \u003c4c\u003e 8b 6e 50 48 89 f3 4d 85 ed 75 03 4c 8b 2e 48 89 df e8 f3 27 98\n[ 148.576204] RSP: 0018:ffffd2fd7ea17a48 EFLAGS: 00010202\n[ 148.576211] RAX: ffffd2fd7ea17aa0 RBX: ffff8eb288ae2000 RCX: 0000000000000000\n[ 148.576217] RDX: ffffd2fd7ea17a70 RSI: 00000000000000c8 RDI: ffffffffb68d3d88\n[ 148.576222] RBP: ffffffffb68d3d88 R08: 0000000000000000 R09: 0000000000000000\n[ 148.576227] R10: 00000000000000c8 R11: ffff8eb2b1a49400 R12: ffffd2fd7ea17a70\n[ 148.576231] R13: ffff8eb3141fb000 R14: ffffffffc1215b48 R15: ffffffffc1215bd8\n[ 148.576236] FS: 00007f5666ba6740(0000) GS:ffff8eb2472b9000(0000) knlGS:0000000000000000\n[ 148.576242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 148.576247] CR2: 0000000000000118 CR3: 000000011ad17000 CR4: 0000000000350ef0\n[ 148.576252] Call Trace:\n[ 148.576258] \u003cTASK\u003e\n[ 148.576269] _dev_warn+0x7c/0x96\n[ 148.576290] libie_fwlog_deinit+0x112/0x117 [libie_fwlog]\n[ 148.576303] ixgbe_remove+0x63/0x290 [ixgbe]\n[ 148.576342] pci_device_remove+0x42/0xb0\n[ 148.576354] device_release_driver_internal+0x19c/0x200\n[ 148.576365] driver_detach+0x48/0x90\n[ 148.576372] bus_remove_driver+0x6d/0xf0\n[ 148.576383] pci_unregister_driver+0x2e/0xb0\n[ 148.576393] ixgbe_exit_module+0x1c/0xd50 [ixgbe]\n[ 148.576430] __do_sys_delete_module.isra.0+0x1bc/0x2e0\n[ 148.576446] do_syscall_64+0x7f/0x980\n\nIt can be reproduced by trying to unload ixgbe driver in recovery mode.\n\nFix that by checking if fwlog is supported before doing unroll."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:21.212Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0138d1cdb19fa49181a5aaba32427f1787cb3935"
},
{
"url": "https://git.kernel.org/stable/c/460c56ecbef57684aad1d6af525b89dcd3565701"
},
{
"url": "https://git.kernel.org/stable/c/636cc3bd12f499c74eaf5dc9a7d5b832f1bb24ed"
}
],
"title": "libie: don\u0027t unroll if fwlog isn\u0027t supported",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23329",
"datePublished": "2026-03-25T10:27:21.212Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:21.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23341 (GCVE-0-2026-23341)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
accel/amdxdna: Fix crash when destroying a suspended hardware context
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix crash when destroying a suspended hardware context
If userspace issues an ioctl to destroy a hardware context that has
already been automatically suspended, the driver may crash because the
mailbox channel pointer is NULL for the suspended context.
Fix this by checking the mailbox channel pointer in aie2_destroy_context()
before accessing it.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6317704edab95d66a62fc1861d9546284ab678e",
"status": "affected",
"version": "2611c9616cb52d3ed54a6095d72d18e645a6955a",
"versionType": "git"
},
{
"lessThan": "8363c02863332992a1822688da41f881d88d1631",
"status": "affected",
"version": "97f27573837ef96b4ba42af463cc800cab615c0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0-rc1"
},
{
"lessThan": "7.0-rc1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "7.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix crash when destroying a suspended hardware context\n\nIf userspace issues an ioctl to destroy a hardware context that has\nalready been automatically suspended, the driver may crash because the\nmailbox channel pointer is NULL for the suspended context.\n\nFix this by checking the mailbox channel pointer in aie2_destroy_context()\nbefore accessing it."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:29.438Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6317704edab95d66a62fc1861d9546284ab678e"
},
{
"url": "https://git.kernel.org/stable/c/8363c02863332992a1822688da41f881d88d1631"
}
],
"title": "accel/amdxdna: Fix crash when destroying a suspended hardware context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23341",
"datePublished": "2026-03-25T10:27:29.438Z",
"dateReserved": "2026-01-13T15:37:45.998Z",
"dateUpdated": "2026-03-25T10:27:29.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23280 (GCVE-0-2026-23280)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
accel/amdxdna: Prevent ubuf size overflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Prevent ubuf size overflow
The ubuf size calculation may overflow, resulting in an undersized
allocation and possible memory corruption.
Use check_add_overflow() helpers to validate the size calculation before
allocation.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
bd72d4acda1069579b35123e3cc0b21ec1193a21 , < 1500b31db94374a6669e73ce94d6f71cf8e85e06
(git)
Affected: bd72d4acda1069579b35123e3cc0b21ec1193a21 , < 972bf4a23478fcb247b4f507d47a584bc8aea5bd (git) Affected: bd72d4acda1069579b35123e3cc0b21ec1193a21 , < 03808abb1d868aed7478a11a82e5bb4b3f1ca6d6 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_ubuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1500b31db94374a6669e73ce94d6f71cf8e85e06",
"status": "affected",
"version": "bd72d4acda1069579b35123e3cc0b21ec1193a21",
"versionType": "git"
},
{
"lessThan": "972bf4a23478fcb247b4f507d47a584bc8aea5bd",
"status": "affected",
"version": "bd72d4acda1069579b35123e3cc0b21ec1193a21",
"versionType": "git"
},
{
"lessThan": "03808abb1d868aed7478a11a82e5bb4b3f1ca6d6",
"status": "affected",
"version": "bd72d4acda1069579b35123e3cc0b21ec1193a21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_ubuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Prevent ubuf size overflow\n\nThe ubuf size calculation may overflow, resulting in an undersized\nallocation and possible memory corruption.\n\nUse check_add_overflow() helpers to validate the size calculation before\nallocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:41.088Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1500b31db94374a6669e73ce94d6f71cf8e85e06"
},
{
"url": "https://git.kernel.org/stable/c/972bf4a23478fcb247b4f507d47a584bc8aea5bd"
},
{
"url": "https://git.kernel.org/stable/c/03808abb1d868aed7478a11a82e5bb4b3f1ca6d6"
}
],
"title": "accel/amdxdna: Prevent ubuf size overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23280",
"datePublished": "2026-03-25T10:26:41.088Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:41.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23354 (GCVE-0-2026-23354)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
x86/fred: Correct speculative safety in fred_extint()
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp across the function call.
Remove the index variable and reposition array_index_nospec(), so it's
calculated immediately before the array access.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
14619d912b658ecd9573fb88400d3830a29cadcb , < 3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643
(git)
Affected: 14619d912b658ecd9573fb88400d3830a29cadcb , < e58f1a9b0677de24dcfee0b21393446ec92ff120 (git) Affected: 14619d912b658ecd9573fb88400d3830a29cadcb , < 92caa5274b99cb6729177232a029ce0dfa6c5f7b (git) Affected: 14619d912b658ecd9573fb88400d3830a29cadcb , < aa280a08e7d8fae58557acc345b36b3dc329d595 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_fred.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643",
"status": "affected",
"version": "14619d912b658ecd9573fb88400d3830a29cadcb",
"versionType": "git"
},
{
"lessThan": "e58f1a9b0677de24dcfee0b21393446ec92ff120",
"status": "affected",
"version": "14619d912b658ecd9573fb88400d3830a29cadcb",
"versionType": "git"
},
{
"lessThan": "92caa5274b99cb6729177232a029ce0dfa6c5f7b",
"status": "affected",
"version": "14619d912b658ecd9573fb88400d3830a29cadcb",
"versionType": "git"
},
{
"lessThan": "aa280a08e7d8fae58557acc345b36b3dc329d595",
"status": "affected",
"version": "14619d912b658ecd9573fb88400d3830a29cadcb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_fred.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fred: Correct speculative safety in fred_extint()\n\narray_index_nospec() is no use if the result gets spilled to the stack, as\nit makes the believed safe-under-speculation value subject to memory\npredictions.\n\nFor all practical purposes, this means array_index_nospec() must be used in\nthe expression that accesses the array.\n\nAs the code currently stands, it\u0027s the wrong side of irqentry_enter(), and\n\u0027index\u0027 is put into %ebp across the function call.\n\nRemove the index variable and reposition array_index_nospec(), so it\u0027s\ncalculated immediately before the array access."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:38.825Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643"
},
{
"url": "https://git.kernel.org/stable/c/e58f1a9b0677de24dcfee0b21393446ec92ff120"
},
{
"url": "https://git.kernel.org/stable/c/92caa5274b99cb6729177232a029ce0dfa6c5f7b"
},
{
"url": "https://git.kernel.org/stable/c/aa280a08e7d8fae58557acc345b36b3dc329d595"
}
],
"title": "x86/fred: Correct speculative safety in fred_extint()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23354",
"datePublished": "2026-03-25T10:27:38.825Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:38.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23395 (GCVE-0-2026-23395)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:33 – Updated: 2026-03-25 10:33
VLAI?
EPSS
Title
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
Currently the code attempts to accept requests regardless of the
command identifier which may cause multiple requests to be marked
as pending (FLAG_DEFER_SETUP) which can cause more than
L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer
causing an overflow.
The spec is quite clear that the same identifier shall not be used on
subsequent requests:
'Within each signaling channel a different Identifier shall be used
for each successive request or indication.'
https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d
So this attempts to check if there are any channels pending with the
same identifier and rejects if any are found.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
15f02b91056253e8cdc592888f431da0731337b8 , < fb4a3a26483f3ea2cd21c7a2f7c45d5670600465
(git)
Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 2124d82fd25e1671bb3ceb37998af5aae5903e06 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 6b949a6b33cbdf621d9fc6f0c48ac00915dbf514 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 8d0d94f8ba5b3a0beec3b0da558b9bea48018117 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < e72ee455297b794b852e5cea8d2d7bb17312172a (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 5b3e2052334f2ff6d5200e952f4aa66994d09899 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb4a3a26483f3ea2cd21c7a2f7c45d5670600465",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "2124d82fd25e1671bb3ceb37998af5aae5903e06",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "6b949a6b33cbdf621d9fc6f0c48ac00915dbf514",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "8d0d94f8ba5b3a0beec3b0da558b9bea48018117",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "e72ee455297b794b852e5cea8d2d7bb17312172a",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "5b3e2052334f2ff6d5200e952f4aa66994d09899",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc5",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ\n\nCurrently the code attempts to accept requests regardless of the\ncommand identifier which may cause multiple requests to be marked\nas pending (FLAG_DEFER_SETUP) which can cause more than\nL2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer\ncausing an overflow.\n\nThe spec is quite clear that the same identifier shall not be used on\nsubsequent requests:\n\n\u0027Within each signaling channel a different Identifier shall be used\nfor each successive request or indication.\u0027\nhttps://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d\n\nSo this attempts to check if there are any channels pending with the\nsame identifier and rejects if any are found."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:33:18.936Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb4a3a26483f3ea2cd21c7a2f7c45d5670600465"
},
{
"url": "https://git.kernel.org/stable/c/2124d82fd25e1671bb3ceb37998af5aae5903e06"
},
{
"url": "https://git.kernel.org/stable/c/6b949a6b33cbdf621d9fc6f0c48ac00915dbf514"
},
{
"url": "https://git.kernel.org/stable/c/8d0d94f8ba5b3a0beec3b0da558b9bea48018117"
},
{
"url": "https://git.kernel.org/stable/c/e72ee455297b794b852e5cea8d2d7bb17312172a"
},
{
"url": "https://git.kernel.org/stable/c/5b3e2052334f2ff6d5200e952f4aa66994d09899"
}
],
"title": "Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23395",
"datePublished": "2026-03-25T10:33:18.936Z",
"dateReserved": "2026-01-13T15:37:46.011Z",
"dateUpdated": "2026-03-25T10:33:18.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23378 (GCVE-0-2026-23378)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net/sched: act_ife: Fix metalist update behavior
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ife: Fix metalist update behavior
Whenever an ife action replace changes the metalist, instead of
replacing the old data on the metalist, the current ife code is appending
the new metadata. Aside from being innapropriate behavior, this may lead
to an unbounded addition of metadata to the metalist which might cause an
out of bounds error when running the encode op:
[ 138.423369][ C1] ==================================================================
[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)
[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255
[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)
[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 138.425800][ C1] Call Trace:
[ 138.425804][ C1] <IRQ>
[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)
[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)
[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)
[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)
[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))
[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))
[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)
[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)
[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)
[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)
[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))
[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)
[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)
To solve this issue, fix the replace behavior by adding the metalist to
the ife rcu data structure.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
aa9fd9a325d51fa0b11153b03b8fefff569fa955 , < 56ade7ddea6ce605552341785d08e365c3f61861
(git)
Affected: aa9fd9a325d51fa0b11153b03b8fefff569fa955 , < 5b1449301ca070814d866990b46f48d3f39ea4ee (git) Affected: aa9fd9a325d51fa0b11153b03b8fefff569fa955 , < 91a89d3bdc2f63d983adc13d1771631663c5dc1b (git) Affected: aa9fd9a325d51fa0b11153b03b8fefff569fa955 , < cd888c3966672239f2e0707b846a5a936ac9038a (git) Affected: aa9fd9a325d51fa0b11153b03b8fefff569fa955 , < 691866c4cca54dc4df762276b49e89b36e046947 (git) Affected: aa9fd9a325d51fa0b11153b03b8fefff569fa955 , < e2cedd400c3ec0302ffca2490e8751772906ac23 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/tc_act/tc_ife.h",
"net/sched/act_ife.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56ade7ddea6ce605552341785d08e365c3f61861",
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"versionType": "git"
},
{
"lessThan": "5b1449301ca070814d866990b46f48d3f39ea4ee",
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"versionType": "git"
},
{
"lessThan": "91a89d3bdc2f63d983adc13d1771631663c5dc1b",
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"versionType": "git"
},
{
"lessThan": "cd888c3966672239f2e0707b846a5a936ac9038a",
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"versionType": "git"
},
{
"lessThan": "691866c4cca54dc4df762276b49e89b36e046947",
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"versionType": "git"
},
{
"lessThan": "e2cedd400c3ec0302ffca2490e8751772906ac23",
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/tc_act/tc_ife.h",
"net/sched/act_ife.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] ==================================================================\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \u003cIRQ\u003e\n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:57.986Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861"
},
{
"url": "https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee"
},
{
"url": "https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b"
},
{
"url": "https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a"
},
{
"url": "https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947"
},
{
"url": "https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23"
}
],
"title": "net/sched: act_ife: Fix metalist update behavior",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23378",
"datePublished": "2026-03-25T10:27:57.986Z",
"dateReserved": "2026-01-13T15:37:46.006Z",
"dateUpdated": "2026-03-25T10:27:57.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23338 (GCVE-0-2026-23338)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
Userspace can either deliberately pass in the too small num_fences, or the
required number can legitimately grow between the two calls to the userq
wait ioctl. In both cases we do not want the emit the kernel warning
backtrace since nothing is wrong with the kernel and userspace will simply
get an errno reported back. So lets simply drop the WARN_ONs.
(cherry picked from commit 2c333ea579de6cc20ea7bc50e9595ef72863e65c)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
a292fdecd72834b3bec380baa5db1e69e7f70679 , < 1753f5f81ab60a553287f9ee659a6ac363adf8d7
(git)
Affected: a292fdecd72834b3bec380baa5db1e69e7f70679 , < 7321302edca3a349ddaea689df95b986beee6c4a (git) Affected: a292fdecd72834b3bec380baa5db1e69e7f70679 , < 7b7d7693a55d606d700beb9549c9f7f0e5d9c24f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1753f5f81ab60a553287f9ee659a6ac363adf8d7",
"status": "affected",
"version": "a292fdecd72834b3bec380baa5db1e69e7f70679",
"versionType": "git"
},
{
"lessThan": "7321302edca3a349ddaea689df95b986beee6c4a",
"status": "affected",
"version": "a292fdecd72834b3bec380baa5db1e69e7f70679",
"versionType": "git"
},
{
"lessThan": "7b7d7693a55d606d700beb9549c9f7f0e5d9c24f",
"status": "affected",
"version": "a292fdecd72834b3bec380baa5db1e69e7f70679",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings\n\nUserspace can either deliberately pass in the too small num_fences, or the\nrequired number can legitimately grow between the two calls to the userq\nwait ioctl. In both cases we do not want the emit the kernel warning\nbacktrace since nothing is wrong with the kernel and userspace will simply\nget an errno reported back. So lets simply drop the WARN_ONs.\n\n(cherry picked from commit 2c333ea579de6cc20ea7bc50e9595ef72863e65c)"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:27.377Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1753f5f81ab60a553287f9ee659a6ac363adf8d7"
},
{
"url": "https://git.kernel.org/stable/c/7321302edca3a349ddaea689df95b986beee6c4a"
},
{
"url": "https://git.kernel.org/stable/c/7b7d7693a55d606d700beb9549c9f7f0e5d9c24f"
}
],
"title": "drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23338",
"datePublished": "2026-03-25T10:27:27.377Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:27.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23343 (GCVE-0-2026-23343)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
xdp: produce a warning when calculated tailroom is negative
Summary
In the Linux kernel, the following vulnerability has been resolved:
xdp: produce a warning when calculated tailroom is negative
Many ethernet drivers report xdp Rx queue frag size as being the same as
DMA write size. However, the only user of this field, namely
bpf_xdp_frags_increase_tail(), clearly expects a truesize.
Such difference leads to unspecific memory corruption issues under certain
circumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when
running xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses
all DMA-writable space in 2 buffers. This would be fine, if only
rxq->frag_size was properly set to 4K, but value of 3K results in a
negative tailroom, because there is a non-zero page offset.
We are supposed to return -EINVAL and be done with it in such case, but due
to tailroom being stored as an unsigned int, it is reported to be somewhere
near UINT_MAX, resulting in a tail being grown, even if the requested
offset is too much (it is around 2K in the abovementioned test). This later
leads to all kinds of unspecific calltraces.
[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6
[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4
[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]
[ 7340.339230] in xskxceiver[42b5,400000+69000]
[ 7340.340300] likely on CPU 6 (core 0, socket 6)
[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 <4c> 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe
[ 7340.340888] likely on CPU 3 (core 0, socket 3)
[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff <8b> 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7
[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI
[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)
[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014
[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80
[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 <8b> 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89
[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202
[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010
[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff
[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0
[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0
[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500
[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000
[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0
[ 7340.421237] PKRU: 55555554
[ 7340.421623] Call Trace:
[ 7340.421987] <TASK>
[ 7340.422309] ? softleaf_from_pte+0x77/0xa0
[ 7340.422855] swap_pte_batch+0xa7/0x290
[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270
[ 7340.424102] zap_pte_range+0x281/0x580
[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240
[ 7340.425177] unmap_page_range+0x24d/0x420
[ 7340.425714] unmap_vmas+0xa1/0x180
[ 7340.426185] exit_mmap+0xe1/0x3b0
[ 7340.426644] __mmput+0x41/0x150
[ 7340.427098] exit_mm+0xb1/0x110
[ 7340.427539] do_exit+0x1b2/0x460
[ 7340.427992] do_group_exit+0x2d/0xc0
[ 7340.428477] get_signal+0x79d/0x7e0
[ 7340.428957] arch_do_signal_or_restart+0x34/0x100
[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0
[ 7340.430159] do_syscall_64+0x188/
---truncated---
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
bf25146a5595269810b1f47d048f114c5ff9f544 , < 01379540452a02bbc52f639d45dd365cd3624efb
(git)
Affected: bf25146a5595269810b1f47d048f114c5ff9f544 , < a0fb59f527d03c60b2cd547cfae4a842ad84670f (git) Affected: bf25146a5595269810b1f47d048f114c5ff9f544 , < c7c790a07697148c41e2d03eb28efe132adda749 (git) Affected: bf25146a5595269810b1f47d048f114c5ff9f544 , < 98cd8b4d0b836d3edf70161f40efd9cbb8c8f252 (git) Affected: bf25146a5595269810b1f47d048f114c5ff9f544 , < 94b9da7e9f958cb3d115b21eff824ecd8c3217aa (git) Affected: bf25146a5595269810b1f47d048f114c5ff9f544 , < 8821e857759be9db3cde337ad328b71fe5c8a55f (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01379540452a02bbc52f639d45dd365cd3624efb",
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"versionType": "git"
},
{
"lessThan": "a0fb59f527d03c60b2cd547cfae4a842ad84670f",
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"versionType": "git"
},
{
"lessThan": "c7c790a07697148c41e2d03eb28efe132adda749",
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"versionType": "git"
},
{
"lessThan": "98cd8b4d0b836d3edf70161f40efd9cbb8c8f252",
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"versionType": "git"
},
{
"lessThan": "94b9da7e9f958cb3d115b21eff824ecd8c3217aa",
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"versionType": "git"
},
{
"lessThan": "8821e857759be9db3cde337ad328b71fe5c8a55f",
"status": "affected",
"version": "bf25146a5595269810b1f47d048f114c5ff9f544",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: produce a warning when calculated tailroom is negative\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver\u0027s XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:31.130Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01379540452a02bbc52f639d45dd365cd3624efb"
},
{
"url": "https://git.kernel.org/stable/c/a0fb59f527d03c60b2cd547cfae4a842ad84670f"
},
{
"url": "https://git.kernel.org/stable/c/c7c790a07697148c41e2d03eb28efe132adda749"
},
{
"url": "https://git.kernel.org/stable/c/98cd8b4d0b836d3edf70161f40efd9cbb8c8f252"
},
{
"url": "https://git.kernel.org/stable/c/94b9da7e9f958cb3d115b21eff824ecd8c3217aa"
},
{
"url": "https://git.kernel.org/stable/c/8821e857759be9db3cde337ad328b71fe5c8a55f"
}
],
"title": "xdp: produce a warning when calculated tailroom is negative",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23343",
"datePublished": "2026-03-25T10:27:31.130Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:31.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23364 (GCVE-0-2026-23364)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
ksmbd: Compare MACs in constant time
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Compare MACs in constant time
To prevent timing attacks, MAC comparisons need to be constant-time.
Replace the memcmp() with the correct function, crypto_memneq().
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < cd52a0e309659537048a864211abc3ea4c5caa63
(git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 307afccb751f542246bd5dc68a2c1ffe1a78418c (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 2cdc56ed67615ba0921383a688f24415ebe065f3 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 93c0a22fec914ec4b697e464895a0f594e29fb28 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < f4588b85efd6007d46b80aa1b9fb746628ffb3dc (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < c5794709bc9105935dbedef8b9cf9c06f2b559fa (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/Kconfig",
"fs/smb/server/auth.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cd52a0e309659537048a864211abc3ea4c5caa63",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "307afccb751f542246bd5dc68a2c1ffe1a78418c",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "2cdc56ed67615ba0921383a688f24415ebe065f3",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "93c0a22fec914ec4b697e464895a0f594e29fb28",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "f4588b85efd6007d46b80aa1b9fb746628ffb3dc",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "c5794709bc9105935dbedef8b9cf9c06f2b559fa",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/Kconfig",
"fs/smb/server/auth.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Compare MACs in constant time\n\nTo prevent timing attacks, MAC comparisons need to be constant-time.\nReplace the memcmp() with the correct function, crypto_memneq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:46.960Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cd52a0e309659537048a864211abc3ea4c5caa63"
},
{
"url": "https://git.kernel.org/stable/c/307afccb751f542246bd5dc68a2c1ffe1a78418c"
},
{
"url": "https://git.kernel.org/stable/c/2cdc56ed67615ba0921383a688f24415ebe065f3"
},
{
"url": "https://git.kernel.org/stable/c/93c0a22fec914ec4b697e464895a0f594e29fb28"
},
{
"url": "https://git.kernel.org/stable/c/f4588b85efd6007d46b80aa1b9fb746628ffb3dc"
},
{
"url": "https://git.kernel.org/stable/c/c5794709bc9105935dbedef8b9cf9c06f2b559fa"
}
],
"title": "ksmbd: Compare MACs in constant time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23364",
"datePublished": "2026-03-25T10:27:46.960Z",
"dateReserved": "2026-01-13T15:37:46.002Z",
"dateUpdated": "2026-03-25T10:27:46.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23392 (GCVE-0-2026-23392)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:33 – Updated: 2026-03-25 10:33
VLAI?
EPSS
Title
netfilter: nf_tables: release flowtable after rcu grace period on error
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: release flowtable after rcu grace period on error
Call synchronize_rcu() after unregistering the hooks from error path,
since a hook that already refers to this flowtable can be already
registered, exposing this flowtable to packet path and nfnetlink_hook
control plane.
This error path is rare, it should only happen by reaching the maximum
number hooks or by failing to set up to hardware offload, just call
synchronize_rcu().
There is a check for already used device hooks by different flowtable
that could result in EEXIST at this late stage. The hook parser can be
updated to perform this check earlier to this error path really becomes
rarely exercised.
Uncovered by KASAN reported as use-after-free from nfnetlink_hook path
when dumping hooks.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < d2632de96ccb066e0131ad1494241b9c281c60b8
(git)
Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < adee3436ccd29f1e514c028899e400cbc6d84065 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 7e3955b282eae20d61c75e499c75eade51c20060 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < c8092edb9a11f20f95ccceeb9422b7dd0df337bd (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < e78a2dcc7cfb87b64a631441ca7681492b347ef6 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < d73f4b53aaaea4c95f245e491aa5eeb8a21874ce (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2632de96ccb066e0131ad1494241b9c281c60b8",
"status": "affected",
"version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
"versionType": "git"
},
{
"lessThan": "adee3436ccd29f1e514c028899e400cbc6d84065",
"status": "affected",
"version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
"versionType": "git"
},
{
"lessThan": "7e3955b282eae20d61c75e499c75eade51c20060",
"status": "affected",
"version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
"versionType": "git"
},
{
"lessThan": "c8092edb9a11f20f95ccceeb9422b7dd0df337bd",
"status": "affected",
"version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
"versionType": "git"
},
{
"lessThan": "e78a2dcc7cfb87b64a631441ca7681492b347ef6",
"status": "affected",
"version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
"versionType": "git"
},
{
"lessThan": "d73f4b53aaaea4c95f245e491aa5eeb8a21874ce",
"status": "affected",
"version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc5",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: release flowtable after rcu grace period on error\n\nCall synchronize_rcu() after unregistering the hooks from error path,\nsince a hook that already refers to this flowtable can be already\nregistered, exposing this flowtable to packet path and nfnetlink_hook\ncontrol plane.\n\nThis error path is rare, it should only happen by reaching the maximum\nnumber hooks or by failing to set up to hardware offload, just call\nsynchronize_rcu().\n\nThere is a check for already used device hooks by different flowtable\nthat could result in EEXIST at this late stage. The hook parser can be\nupdated to perform this check earlier to this error path really becomes\nrarely exercised.\n\nUncovered by KASAN reported as use-after-free from nfnetlink_hook path\nwhen dumping hooks."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:33:16.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2632de96ccb066e0131ad1494241b9c281c60b8"
},
{
"url": "https://git.kernel.org/stable/c/adee3436ccd29f1e514c028899e400cbc6d84065"
},
{
"url": "https://git.kernel.org/stable/c/7e3955b282eae20d61c75e499c75eade51c20060"
},
{
"url": "https://git.kernel.org/stable/c/c8092edb9a11f20f95ccceeb9422b7dd0df337bd"
},
{
"url": "https://git.kernel.org/stable/c/e78a2dcc7cfb87b64a631441ca7681492b347ef6"
},
{
"url": "https://git.kernel.org/stable/c/d73f4b53aaaea4c95f245e491aa5eeb8a21874ce"
}
],
"title": "netfilter: nf_tables: release flowtable after rcu grace period on error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23392",
"datePublished": "2026-03-25T10:33:16.647Z",
"dateReserved": "2026-01-13T15:37:46.011Z",
"dateUpdated": "2026-03-25T10:33:16.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23366 (GCVE-0-2026-23366)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
drm/client: Do not destroy NULL modes
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/client: Do not destroy NULL modes
'modes' in drm_client_modeset_probe may fail to kcalloc. If this
occurs, we jump to 'out', calling modes_destroy on it, which
dereferences it. This may result in a NULL pointer dereference in the
error case. Prevent that.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3039cc0c0653c6e15130a8719c3237329a954670 , < 4e3ca5f82346cc23c0a71f1ceb006115ff6b0745
(git)
Affected: 3039cc0c0653c6e15130a8719c3237329a954670 , < 9aa3e33f0c7f2679ac599a09e3102c8f716a6321 (git) Affected: 3039cc0c0653c6e15130a8719c3237329a954670 , < c601fd5414315fc515f746b499110e46272e7243 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_client_modeset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e3ca5f82346cc23c0a71f1ceb006115ff6b0745",
"status": "affected",
"version": "3039cc0c0653c6e15130a8719c3237329a954670",
"versionType": "git"
},
{
"lessThan": "9aa3e33f0c7f2679ac599a09e3102c8f716a6321",
"status": "affected",
"version": "3039cc0c0653c6e15130a8719c3237329a954670",
"versionType": "git"
},
{
"lessThan": "c601fd5414315fc515f746b499110e46272e7243",
"status": "affected",
"version": "3039cc0c0653c6e15130a8719c3237329a954670",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_client_modeset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Do not destroy NULL modes\n\n\u0027modes\u0027 in drm_client_modeset_probe may fail to kcalloc. If this\noccurs, we jump to \u0027out\u0027, calling modes_destroy on it, which\ndereferences it. This may result in a NULL pointer dereference in the\nerror case. Prevent that."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:48.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745"
},
{
"url": "https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321"
},
{
"url": "https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243"
}
],
"title": "drm/client: Do not destroy NULL modes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23366",
"datePublished": "2026-03-25T10:27:48.311Z",
"dateReserved": "2026-01-13T15:37:46.002Z",
"dateUpdated": "2026-03-25T10:27:48.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23365 (GCVE-0-2026-23365)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net: usb: kalmia: validate USB endpoints
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kalmia: validate USB endpoints
The kalmia driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d40261236e8e278cb1936cb5e934262971692b10 , < 28a380bfa5bc7f6a9380b85e8eab919ee6ac1701
(git)
Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 12c0243de0aee0ab27cc00932fd5edae65c1e3a2 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 51c20ea5f1555a984c041b0dbf56f00d41b9e652 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 011684cd18349aa4c52167c8ac37a0524169f48c (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < 7bfda1a0be4caec3263753d567678451cef73a85 (git) Affected: d40261236e8e278cb1936cb5e934262971692b10 , < c58b6c29a4c9b8125e8ad3bca0637e00b71e2693 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kalmia.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "28a380bfa5bc7f6a9380b85e8eab919ee6ac1701",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "12c0243de0aee0ab27cc00932fd5edae65c1e3a2",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "51c20ea5f1555a984c041b0dbf56f00d41b9e652",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "011684cd18349aa4c52167c8ac37a0524169f48c",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "7bfda1a0be4caec3263753d567678451cef73a85",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
},
{
"lessThan": "c58b6c29a4c9b8125e8ad3bca0637e00b71e2693",
"status": "affected",
"version": "d40261236e8e278cb1936cb5e934262971692b10",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kalmia.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kalmia: validate USB endpoints\n\nThe kalmia driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it. If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:47.609Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/28a380bfa5bc7f6a9380b85e8eab919ee6ac1701"
},
{
"url": "https://git.kernel.org/stable/c/12c0243de0aee0ab27cc00932fd5edae65c1e3a2"
},
{
"url": "https://git.kernel.org/stable/c/51c20ea5f1555a984c041b0dbf56f00d41b9e652"
},
{
"url": "https://git.kernel.org/stable/c/011684cd18349aa4c52167c8ac37a0524169f48c"
},
{
"url": "https://git.kernel.org/stable/c/7bfda1a0be4caec3263753d567678451cef73a85"
},
{
"url": "https://git.kernel.org/stable/c/c58b6c29a4c9b8125e8ad3bca0637e00b71e2693"
}
],
"title": "net: usb: kalmia: validate USB endpoints",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23365",
"datePublished": "2026-03-25T10:27:47.609Z",
"dateReserved": "2026-01-13T15:37:46.002Z",
"dateUpdated": "2026-03-25T10:27:47.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23382 (GCVE-0-2026-23382)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 16:49
VLAI?
EPSS
Title
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at
raw event handle"), we handle the fact that raw event callbacks
can happen even for a HID device that has not been "claimed" causing a
crash if a broken device were attempted to be connected to the system.
Fix up the remaining in-tree HID drivers that forgot to add this same
check to resolve the same issue.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d0742abaa1c396a26bb3d3ce2732988cd3faa020 , < ac83b0d91a3f4f0c012ba9c85fb99436cddb1208
(git)
Affected: d0742abaa1c396a26bb3d3ce2732988cd3faa020 , < 6e330889e6c8db99f04d4feb861d23de4e8fbb13 (git) Affected: d0742abaa1c396a26bb3d3ce2732988cd3faa020 , < 892dbaf46bb738dacf1fa663eadb3712c85868f0 (git) Affected: d0742abaa1c396a26bb3d3ce2732988cd3faa020 , < 20864e3e41c74cda253a9fa6b6fe093c1461a6a9 (git) Affected: d0742abaa1c396a26bb3d3ce2732988cd3faa020 , < 575122cd6569c4c4aa13c4c9958fea506724c788 (git) Affected: d0742abaa1c396a26bb3d3ce2732988cd3faa020 , < ecfa6f34492c493a9a1dc2900f3edeb01c79946b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-cmedia.c",
"drivers/hid/hid-creative-sb0540.c",
"drivers/hid/hid-zydacron.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac83b0d91a3f4f0c012ba9c85fb99436cddb1208",
"status": "affected",
"version": "d0742abaa1c396a26bb3d3ce2732988cd3faa020",
"versionType": "git"
},
{
"lessThan": "6e330889e6c8db99f04d4feb861d23de4e8fbb13",
"status": "affected",
"version": "d0742abaa1c396a26bb3d3ce2732988cd3faa020",
"versionType": "git"
},
{
"lessThan": "892dbaf46bb738dacf1fa663eadb3712c85868f0",
"status": "affected",
"version": "d0742abaa1c396a26bb3d3ce2732988cd3faa020",
"versionType": "git"
},
{
"lessThan": "20864e3e41c74cda253a9fa6b6fe093c1461a6a9",
"status": "affected",
"version": "d0742abaa1c396a26bb3d3ce2732988cd3faa020",
"versionType": "git"
},
{
"lessThan": "575122cd6569c4c4aa13c4c9958fea506724c788",
"status": "affected",
"version": "d0742abaa1c396a26bb3d3ce2732988cd3faa020",
"versionType": "git"
},
{
"lessThan": "ecfa6f34492c493a9a1dc2900f3edeb01c79946b",
"status": "affected",
"version": "d0742abaa1c396a26bb3d3ce2732988cd3faa020",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-cmedia.c",
"drivers/hid/hid-creative-sb0540.c",
"drivers/hid/hid-zydacron.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them\n\nIn commit 2ff5baa9b527 (\"HID: appleir: Fix potential NULL dereference at\nraw event handle\"), we handle the fact that raw event callbacks\ncan happen even for a HID device that has not been \"claimed\" causing a\ncrash if a broken device were attempted to be connected to the system.\n\nFix up the remaining in-tree HID drivers that forgot to add this same\ncheck to resolve the same issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:49:16.018Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac83b0d91a3f4f0c012ba9c85fb99436cddb1208"
},
{
"url": "https://git.kernel.org/stable/c/6e330889e6c8db99f04d4feb861d23de4e8fbb13"
},
{
"url": "https://git.kernel.org/stable/c/892dbaf46bb738dacf1fa663eadb3712c85868f0"
},
{
"url": "https://git.kernel.org/stable/c/20864e3e41c74cda253a9fa6b6fe093c1461a6a9"
},
{
"url": "https://git.kernel.org/stable/c/575122cd6569c4c4aa13c4c9958fea506724c788"
},
{
"url": "https://git.kernel.org/stable/c/ecfa6f34492c493a9a1dc2900f3edeb01c79946b"
}
],
"title": "HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23382",
"datePublished": "2026-03-25T10:28:01.040Z",
"dateReserved": "2026-01-13T15:37:46.007Z",
"dateUpdated": "2026-03-25T16:49:16.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23351 (GCVE-0-2026-23351)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
Yiming Qian reports Use-after-free in the pipapo set type:
Under a large number of expired elements, commit-time GC can run for a very
long time in a non-preemptible context, triggering soft lockup warnings and
RCU stall reports (local denial of service).
We must split GC in an unlink and a reclaim phase.
We cannot queue elements for freeing until pointers have been swapped.
Expired elements are still exposed to both the packet path and userspace
dumpers via the live copy of the data structure.
call_rcu() does not protect us: dump operations or element lookups starting
after call_rcu has fired can still observe the free'd element, unless the
commit phase has made enough progress to swap the clone and live pointers
before any new reader has picked up the old version.
This a similar approach as done recently for the rbtree backend in commit
35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
3c4287f62044a90e73a561aa05fc46e62da173da , < 16f3595c0441d87dfa005c47d8f95be213afaa9e
(git)
Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 7864c667aed01a58b87ca518a631322cd0ac34c0 (git) Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < c12d570d71920903a1a0468b7d13b085203d0c93 (git) Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 500a50a301ce962b019ab95053ac70264fec2c21 (git) Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < aff13667708dfa0dce136b8efd81baa9fa6ef261 (git) Affected: 3c4287f62044a90e73a561aa05fc46e62da173da , < 9df95785d3d8302f7c066050117b04cd3c2048c2 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_pipapo.c",
"net/netfilter/nft_set_pipapo.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16f3595c0441d87dfa005c47d8f95be213afaa9e",
"status": "affected",
"version": "3c4287f62044a90e73a561aa05fc46e62da173da",
"versionType": "git"
},
{
"lessThan": "7864c667aed01a58b87ca518a631322cd0ac34c0",
"status": "affected",
"version": "3c4287f62044a90e73a561aa05fc46e62da173da",
"versionType": "git"
},
{
"lessThan": "c12d570d71920903a1a0468b7d13b085203d0c93",
"status": "affected",
"version": "3c4287f62044a90e73a561aa05fc46e62da173da",
"versionType": "git"
},
{
"lessThan": "500a50a301ce962b019ab95053ac70264fec2c21",
"status": "affected",
"version": "3c4287f62044a90e73a561aa05fc46e62da173da",
"versionType": "git"
},
{
"lessThan": "aff13667708dfa0dce136b8efd81baa9fa6ef261",
"status": "affected",
"version": "3c4287f62044a90e73a561aa05fc46e62da173da",
"versionType": "git"
},
{
"lessThan": "9df95785d3d8302f7c066050117b04cd3c2048c2",
"status": "affected",
"version": "3c4287f62044a90e73a561aa05fc46e62da173da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_pipapo.c",
"net/netfilter/nft_set_pipapo.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: split gc into unlink and reclaim phase\n\nYiming Qian reports Use-after-free in the pipapo set type:\n Under a large number of expired elements, commit-time GC can run for a very\n long time in a non-preemptible context, triggering soft lockup warnings and\n RCU stall reports (local denial of service).\n\nWe must split GC in an unlink and a reclaim phase.\n\nWe cannot queue elements for freeing until pointers have been swapped.\nExpired elements are still exposed to both the packet path and userspace\ndumpers via the live copy of the data structure.\n\ncall_rcu() does not protect us: dump operations or element lookups starting\nafter call_rcu has fired can still observe the free\u0027d element, unless the\ncommit phase has made enough progress to swap the clone and live pointers\nbefore any new reader has picked up the old version.\n\nThis a similar approach as done recently for the rbtree backend in commit\n35f83a75529a (\"netfilter: nft_set_rbtree: don\u0027t gc elements on insert\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:36.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16f3595c0441d87dfa005c47d8f95be213afaa9e"
},
{
"url": "https://git.kernel.org/stable/c/7864c667aed01a58b87ca518a631322cd0ac34c0"
},
{
"url": "https://git.kernel.org/stable/c/c12d570d71920903a1a0468b7d13b085203d0c93"
},
{
"url": "https://git.kernel.org/stable/c/500a50a301ce962b019ab95053ac70264fec2c21"
},
{
"url": "https://git.kernel.org/stable/c/aff13667708dfa0dce136b8efd81baa9fa6ef261"
},
{
"url": "https://git.kernel.org/stable/c/9df95785d3d8302f7c066050117b04cd3c2048c2"
}
],
"title": "netfilter: nft_set_pipapo: split gc into unlink and reclaim phase",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23351",
"datePublished": "2026-03-25T10:27:36.854Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:36.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23370 (GCVE-0-2026-23370)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
set_new_password() hex dumps the entire buffer, which contains plaintext
password data, including current and new passwords. Remove the hex dump
to avoid leaking credentials.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
e8a60aa7404bfef37705da5607c97737073ac38d , < d9e785bd62d2ac23cf29a75dcfea8c8087fd3870
(git)
Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 411ba3cd837f7825c0e648e155bc505641f95854 (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 0e6115c2f2facaed9593c16ad2e5accd487f5c52 (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < 5de34126fb2edf8ab7f25d677b132e92d8bf9ede (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < d78e74adc5cfff7afd9d03b9da8058a7e435f9bc (git) Affected: e8a60aa7404bfef37705da5607c97737073ac38d , < d1a196e0a6dcddd03748468a0e9e3100790fc85c (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-sysman/passwordattr-interface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d9e785bd62d2ac23cf29a75dcfea8c8087fd3870",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "411ba3cd837f7825c0e648e155bc505641f95854",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "0e6115c2f2facaed9593c16ad2e5accd487f5c52",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "5de34126fb2edf8ab7f25d677b132e92d8bf9ede",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "d78e74adc5cfff7afd9d03b9da8058a7e435f9bc",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "d1a196e0a6dcddd03748468a0e9e3100790fc85c",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-sysman/passwordattr-interface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Don\u0027t hex dump plaintext password data\n\nset_new_password() hex dumps the entire buffer, which contains plaintext\npassword data, including current and new passwords. Remove the hex dump\nto avoid leaking credentials."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:51.370Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d9e785bd62d2ac23cf29a75dcfea8c8087fd3870"
},
{
"url": "https://git.kernel.org/stable/c/411ba3cd837f7825c0e648e155bc505641f95854"
},
{
"url": "https://git.kernel.org/stable/c/0e6115c2f2facaed9593c16ad2e5accd487f5c52"
},
{
"url": "https://git.kernel.org/stable/c/5de34126fb2edf8ab7f25d677b132e92d8bf9ede"
},
{
"url": "https://git.kernel.org/stable/c/d78e74adc5cfff7afd9d03b9da8058a7e435f9bc"
},
{
"url": "https://git.kernel.org/stable/c/d1a196e0a6dcddd03748468a0e9e3100790fc85c"
}
],
"title": "platform/x86: dell-wmi-sysman: Don\u0027t hex dump plaintext password data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23370",
"datePublished": "2026-03-25T10:27:51.370Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:51.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23286 (GCVE-0-2026-23286)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
Summary
In the Linux kernel, the following vulnerability has been resolved:
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
This issue can be easily reproduced using the syzkaller reproducer.
In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by
multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).
When the underlying VCC is closed, lec_vcc_close() iterates over all
ARP entries and calls lec_arp_clear_vccs() for each matched entry.
For example, when lec_vcc_close() iterates through the hlists in
priv->lec_arp_empty_ones or other ARP tables:
1. In the first iteration, for the first matched ARP entry sharing the VCC,
lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)
and sets vcc->user_back to NULL.
2. In the second iteration, for the next matched ARP entry sharing the same
VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from
vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it
via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.
Fix this by adding a null check for vpriv before dereferencing
it. If vpriv is already NULL, it means the VCC has been cleared
by a previous call, so we can safely skip the cleanup and just
clear the entry's vcc/recv_vcc pointers.
The entire cleanup block (including vcc_release_async()) is placed inside
the vpriv guard because a NULL vpriv indicates the VCC has already been
fully released by a prior iteration — repeating the teardown would
redundantly set flags and trigger callbacks on an already-closing socket.
The Fixes tag points to the initial commit because the entry->vcc path has
been vulnerable since the original code. The entry->recv_vcc path was later
added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back")
with the same pattern, and both paths are fixed here.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e9665986eb127290ceb535bd5d04d7a84265d94f
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 622062f24644b4536d3f437e0cf7a8c4bb421665 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2d9f57ea29a1f1772373b98a509b44d49fda609e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7ea92ab075d809ec8a96669a5ecf00f752057875 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5f1cfea7921f5c126a441d973690eeba52677b64 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/atm/lec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9665986eb127290ceb535bd5d04d7a84265d94f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "622062f24644b4536d3f437e0cf7a8c4bb421665",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2d9f57ea29a1f1772373b98a509b44d49fda609e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7ea92ab075d809ec8a96669a5ecf00f752057875",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5f1cfea7921f5c126a441d973690eeba52677b64",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/atm/lec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: lec: fix null-ptr-deref in lec_arp_clear_vccs\n\nsyzkaller reported a null-ptr-deref in lec_arp_clear_vccs().\nThis issue can be easily reproduced using the syzkaller reproducer.\n\nIn the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by\nmultiple lec_arp_table entries (e.g., via entry-\u003evcc or entry-\u003erecv_vcc).\nWhen the underlying VCC is closed, lec_vcc_close() iterates over all\nARP entries and calls lec_arp_clear_vccs() for each matched entry.\n\nFor example, when lec_vcc_close() iterates through the hlists in\npriv-\u003elec_arp_empty_ones or other ARP tables:\n\n1. In the first iteration, for the first matched ARP entry sharing the VCC,\nlec_arp_clear_vccs() frees the associated vpriv (which is vcc-\u003euser_back)\nand sets vcc-\u003euser_back to NULL.\n2. In the second iteration, for the next matched ARP entry sharing the same\nVCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from\nvcc-\u003euser_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it\nvia `vcc-\u003epop = vpriv-\u003eold_pop`, leading to a null-ptr-deref crash.\n\nFix this by adding a null check for vpriv before dereferencing\nit. If vpriv is already NULL, it means the VCC has been cleared\nby a previous call, so we can safely skip the cleanup and just\nclear the entry\u0027s vcc/recv_vcc pointers.\n\nThe entire cleanup block (including vcc_release_async()) is placed inside\nthe vpriv guard because a NULL vpriv indicates the VCC has already been\nfully released by a prior iteration \u2014 repeating the teardown would\nredundantly set flags and trigger callbacks on an already-closing socket.\n\nThe Fixes tag points to the initial commit because the entry-\u003evcc path has\nbeen vulnerable since the original code. The entry-\u003erecv_vcc path was later\nadded by commit 8d9f73c0ad2f (\"atm: fix a memory leak of vcc-\u003euser_back\")\nwith the same pattern, and both paths are fixed here."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:45.531Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9665986eb127290ceb535bd5d04d7a84265d94f"
},
{
"url": "https://git.kernel.org/stable/c/622062f24644b4536d3f437e0cf7a8c4bb421665"
},
{
"url": "https://git.kernel.org/stable/c/2d9f57ea29a1f1772373b98a509b44d49fda609e"
},
{
"url": "https://git.kernel.org/stable/c/7ea92ab075d809ec8a96669a5ecf00f752057875"
},
{
"url": "https://git.kernel.org/stable/c/5f1cfea7921f5c126a441d973690eeba52677b64"
},
{
"url": "https://git.kernel.org/stable/c/101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb"
}
],
"title": "atm: lec: fix null-ptr-deref in lec_arp_clear_vccs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23286",
"datePublished": "2026-03-25T10:26:45.531Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:45.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23339 (GCVE-0-2026-23339)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
nfc: nci: free skb on nci_transceive early error paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: free skb on nci_transceive early error paths
nci_transceive() takes ownership of the skb passed by the caller,
but the -EPROTO, -EINVAL, and -EBUSY error paths return without
freeing it.
Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes
the nci/nci_dev selftest hits the error path occasionally in NIPA,
and kmemleak detects leaks:
unreferenced object 0xff11000015ce6a40 (size 640):
comm "nci_dev", pid 3954, jiffies 4295441246
hex dump (first 32 bytes):
6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk
6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
backtrace (crc 7c40cc2a):
kmem_cache_alloc_node_noprof+0x492/0x630
__alloc_skb+0x11e/0x5f0
alloc_skb_with_frags+0xc6/0x8f0
sock_alloc_send_pskb+0x326/0x3f0
nfc_alloc_send_skb+0x94/0x1d0
rawsock_sendmsg+0x162/0x4c0
do_syscall_64+0x117/0xfc0
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 33f6b8a96dda045789796c3bcb451c74ac158039
(git)
Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < dcbcccfc5195c9caaa4bb8d31f23c345f00a9e89 (git) Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 3245801d44a44c090acefe19a12d22d12cac45c5 (git) Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 9d448bbab724b94d6c561e1f314656f5b88a7cb3 (git) Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 54f7f0eaafa56b5994cdb5c7967946922c2e1d22 (git) Affected: 6a2968aaf50c7a22fced77a5e24aa636281efca8 , < 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "33f6b8a96dda045789796c3bcb451c74ac158039",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "dcbcccfc5195c9caaa4bb8d31f23c345f00a9e89",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "3245801d44a44c090acefe19a12d22d12cac45c5",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "9d448bbab724b94d6c561e1f314656f5b88a7cb3",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "54f7f0eaafa56b5994cdb5c7967946922c2e1d22",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "7bd4b0c4779f978a6528c9b7937d2ca18e936e2c",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: free skb on nci_transceive early error paths\n\nnci_transceive() takes ownership of the skb passed by the caller,\nbut the -EPROTO, -EINVAL, and -EBUSY error paths return without\nfreeing it.\n\nDue to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes\nthe nci/nci_dev selftest hits the error path occasionally in NIPA,\nand kmemleak detects leaks:\n\nunreferenced object 0xff11000015ce6a40 (size 640):\n comm \"nci_dev\", pid 3954, jiffies 4295441246\n hex dump (first 32 bytes):\n 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk\n 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n backtrace (crc 7c40cc2a):\n kmem_cache_alloc_node_noprof+0x492/0x630\n __alloc_skb+0x11e/0x5f0\n alloc_skb_with_frags+0xc6/0x8f0\n sock_alloc_send_pskb+0x326/0x3f0\n nfc_alloc_send_skb+0x94/0x1d0\n rawsock_sendmsg+0x162/0x4c0\n do_syscall_64+0x117/0xfc0"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:28.073Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/33f6b8a96dda045789796c3bcb451c74ac158039"
},
{
"url": "https://git.kernel.org/stable/c/dcbcccfc5195c9caaa4bb8d31f23c345f00a9e89"
},
{
"url": "https://git.kernel.org/stable/c/3245801d44a44c090acefe19a12d22d12cac45c5"
},
{
"url": "https://git.kernel.org/stable/c/9d448bbab724b94d6c561e1f314656f5b88a7cb3"
},
{
"url": "https://git.kernel.org/stable/c/54f7f0eaafa56b5994cdb5c7967946922c2e1d22"
},
{
"url": "https://git.kernel.org/stable/c/7bd4b0c4779f978a6528c9b7937d2ca18e936e2c"
}
],
"title": "nfc: nci: free skb on nci_transceive early error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23339",
"datePublished": "2026-03-25T10:27:28.073Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:28.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23380 (GCVE-0-2026-23380)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
tracing: Fix WARN_ON in tracing_buffers_mmap_close
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix WARN_ON in tracing_buffers_mmap_close
When a process forks, the child process copies the parent's VMAs but the
user_mapped reference count is not incremented. As a result, when both the
parent and child processes exit, tracing_buffers_mmap_close() is called
twice. On the second call, user_mapped is already 0, causing the function to
return -ENODEV and triggering a WARN_ON.
Normally, this isn't an issue as the memory is mapped with VM_DONTCOPY set.
But this is only a hint, and the application can call
madvise(MADVISE_DOFORK) which resets the VM_DONTCOPY flag. When the
application does that, it can trigger this issue on fork.
Fix it by incrementing the user_mapped reference count without re-mapping
the pages in the VMA's open callback.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 , < 91f3e8d84c89918769e71393f839c9fefadc2580
(git)
Affected: cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 , < cdd96641b64297a2db42676f051362b76280a58b (git) Affected: cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 , < b0f269ba6fefe9e3cb9feedcf78fcd0b633800c0 (git) Affected: cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 , < e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/ring_buffer.h",
"kernel/trace/ring_buffer.c",
"kernel/trace/trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91f3e8d84c89918769e71393f839c9fefadc2580",
"status": "affected",
"version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
"versionType": "git"
},
{
"lessThan": "cdd96641b64297a2db42676f051362b76280a58b",
"status": "affected",
"version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
"versionType": "git"
},
{
"lessThan": "b0f269ba6fefe9e3cb9feedcf78fcd0b633800c0",
"status": "affected",
"version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
"versionType": "git"
},
{
"lessThan": "e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e",
"status": "affected",
"version": "cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/ring_buffer.h",
"kernel/trace/ring_buffer.c",
"kernel/trace/trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix WARN_ON in tracing_buffers_mmap_close\n\nWhen a process forks, the child process copies the parent\u0027s VMAs but the\nuser_mapped reference count is not incremented. As a result, when both the\nparent and child processes exit, tracing_buffers_mmap_close() is called\ntwice. On the second call, user_mapped is already 0, causing the function to\nreturn -ENODEV and triggering a WARN_ON.\n\nNormally, this isn\u0027t an issue as the memory is mapped with VM_DONTCOPY set.\nBut this is only a hint, and the application can call\nmadvise(MADVISE_DOFORK) which resets the VM_DONTCOPY flag. When the\napplication does that, it can trigger this issue on fork.\n\nFix it by incrementing the user_mapped reference count without re-mapping\nthe pages in the VMA\u0027s open callback."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:59.682Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91f3e8d84c89918769e71393f839c9fefadc2580"
},
{
"url": "https://git.kernel.org/stable/c/cdd96641b64297a2db42676f051362b76280a58b"
},
{
"url": "https://git.kernel.org/stable/c/b0f269ba6fefe9e3cb9feedcf78fcd0b633800c0"
},
{
"url": "https://git.kernel.org/stable/c/e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e"
}
],
"title": "tracing: Fix WARN_ON in tracing_buffers_mmap_close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23380",
"datePublished": "2026-03-25T10:27:59.682Z",
"dateReserved": "2026-01-13T15:37:46.007Z",
"dateUpdated": "2026-03-25T10:27:59.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23371 (GCVE-0-2026-23371)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
Running stress-ng --schedpolicy 0 on an RT kernel on a big machine
might lead to the following WARNINGs (edited).
sched: DL de-boosted task PID 22725: REPLENISH flag missing
WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8
... (running_bw underflow)
Call trace:
dequeue_task_dl+0x15c/0x1f8 (P)
dequeue_task+0x80/0x168
deactivate_task+0x24/0x50
push_dl_task+0x264/0x2e0
dl_task_timer+0x1b0/0x228
__hrtimer_run_queues+0x188/0x378
hrtimer_interrupt+0xfc/0x260
...
The problem is that when a SCHED_DEADLINE task (lock holder) is
changed to a lower priority class via sched_setscheduler(), it may
fail to properly inherit the parameters of potential DEADLINE donors
if it didn't already inherit them in the past (shorter deadline than
donor's at that time). This might lead to bandwidth accounting
corruption, as enqueue_task_dl() won't recognize the lock holder as
boosted.
The scenario occurs when:
1. A DEADLINE task (donor) blocks on a PI mutex held by another
DEADLINE task (holder), but the holder doesn't inherit parameters
(e.g., it already has a shorter deadline)
2. sched_setscheduler() changes the holder from DEADLINE to a lower
class while still holding the mutex
3. The holder should now inherit DEADLINE parameters from the donor
and be enqueued with ENQUEUE_REPLENISH, but this doesn't happen
Fix the issue by introducing __setscheduler_dl_pi(), which detects when
a DEADLINE (proper or boosted) task gets setscheduled to a lower
priority class. In case, the function makes the task inherit DEADLINE
parameters of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to
ensure proper bandwidth accounting during the next enqueue operation.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
2279f540ea7d05f22d2f0c4224319330228586bc , < ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3
(git)
Affected: 2279f540ea7d05f22d2f0c4224319330228586bc , < d658686a1331db3bb108ca079d76deb3208ed949 (git) Affected: 3cc3d77dc541181f97f1dc96d2977ef8359fd760 (git) Affected: d2b65976bf1ae9d0d9dd5770cd01695559438309 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/syscalls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"lessThan": "d658686a1331db3bb108ca079d76deb3208ed949",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"status": "affected",
"version": "3cc3d77dc541181f97f1dc96d2977ef8359fd760",
"versionType": "git"
},
{
"status": "affected",
"version": "d2b65976bf1ae9d0d9dd5770cd01695559438309",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/syscalls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.212",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting\n\nRunning stress-ng --schedpolicy 0 on an RT kernel on a big machine\nmight lead to the following WARNINGs (edited).\n\n sched: DL de-boosted task PID 22725: REPLENISH flag missing\n\n WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8\n ... (running_bw underflow)\n Call trace:\n dequeue_task_dl+0x15c/0x1f8 (P)\n dequeue_task+0x80/0x168\n deactivate_task+0x24/0x50\n push_dl_task+0x264/0x2e0\n dl_task_timer+0x1b0/0x228\n __hrtimer_run_queues+0x188/0x378\n hrtimer_interrupt+0xfc/0x260\n ...\n\nThe problem is that when a SCHED_DEADLINE task (lock holder) is\nchanged to a lower priority class via sched_setscheduler(), it may\nfail to properly inherit the parameters of potential DEADLINE donors\nif it didn\u0027t already inherit them in the past (shorter deadline than\ndonor\u0027s at that time). This might lead to bandwidth accounting\ncorruption, as enqueue_task_dl() won\u0027t recognize the lock holder as\nboosted.\n\nThe scenario occurs when:\n1. A DEADLINE task (donor) blocks on a PI mutex held by another\n DEADLINE task (holder), but the holder doesn\u0027t inherit parameters\n (e.g., it already has a shorter deadline)\n2. sched_setscheduler() changes the holder from DEADLINE to a lower\n class while still holding the mutex\n3. The holder should now inherit DEADLINE parameters from the donor\n and be enqueued with ENQUEUE_REPLENISH, but this doesn\u0027t happen\n\nFix the issue by introducing __setscheduler_dl_pi(), which detects when\na DEADLINE (proper or boosted) task gets setscheduled to a lower\npriority class. In case, the function makes the task inherit DEADLINE\nparameters of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to\nensure proper bandwidth accounting during the next enqueue operation."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:52.158Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3"
},
{
"url": "https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"
}
],
"title": "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23371",
"datePublished": "2026-03-25T10:27:52.158Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:52.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23315 (GCVE-0-2026-23315)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
Check frame length before accessing the mgmt fields in
mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob
access.
[fix check to also cover mgmt->u.action.u.addba_req.capab,
correct Fixes tag]
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
577dbc6c656da6997dddc6cf842b7954588f2d4e , < 84419556359bc96d3fe1623d47a64c86542566cc
(git)
Affected: 577dbc6c656da6997dddc6cf842b7954588f2d4e , < 7ae7b093b7dba9548a3bc4766b9364b97db4732d (git) Affected: 577dbc6c656da6997dddc6cf842b7954588f2d4e , < 7b692dff8df0ba5feb8df00f27d906d6eb1fe627 (git) Affected: 577dbc6c656da6997dddc6cf842b7954588f2d4e , < 9612d91f617231e03c49cb9b0c02f975a3b4f51f (git) Affected: 577dbc6c656da6997dddc6cf842b7954588f2d4e , < 0fb3b94a9431a3800717e5c3b6fa2e1045a15029 (git) Affected: 577dbc6c656da6997dddc6cf842b7954588f2d4e , < 4e10a730d1b511ff49723371ed6d694dd1b2c785 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "84419556359bc96d3fe1623d47a64c86542566cc",
"status": "affected",
"version": "577dbc6c656da6997dddc6cf842b7954588f2d4e",
"versionType": "git"
},
{
"lessThan": "7ae7b093b7dba9548a3bc4766b9364b97db4732d",
"status": "affected",
"version": "577dbc6c656da6997dddc6cf842b7954588f2d4e",
"versionType": "git"
},
{
"lessThan": "7b692dff8df0ba5feb8df00f27d906d6eb1fe627",
"status": "affected",
"version": "577dbc6c656da6997dddc6cf842b7954588f2d4e",
"versionType": "git"
},
{
"lessThan": "9612d91f617231e03c49cb9b0c02f975a3b4f51f",
"status": "affected",
"version": "577dbc6c656da6997dddc6cf842b7954588f2d4e",
"versionType": "git"
},
{
"lessThan": "0fb3b94a9431a3800717e5c3b6fa2e1045a15029",
"status": "affected",
"version": "577dbc6c656da6997dddc6cf842b7954588f2d4e",
"versionType": "git"
},
{
"lessThan": "4e10a730d1b511ff49723371ed6d694dd1b2c785",
"status": "affected",
"version": "577dbc6c656da6997dddc6cf842b7954588f2d4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob\naccess.\n\n[fix check to also cover mgmt-\u003eu.action.u.addba_req.capab,\ncorrect Fixes tag]"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:10.115Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/84419556359bc96d3fe1623d47a64c86542566cc"
},
{
"url": "https://git.kernel.org/stable/c/7ae7b093b7dba9548a3bc4766b9364b97db4732d"
},
{
"url": "https://git.kernel.org/stable/c/7b692dff8df0ba5feb8df00f27d906d6eb1fe627"
},
{
"url": "https://git.kernel.org/stable/c/9612d91f617231e03c49cb9b0c02f975a3b4f51f"
},
{
"url": "https://git.kernel.org/stable/c/0fb3b94a9431a3800717e5c3b6fa2e1045a15029"
},
{
"url": "https://git.kernel.org/stable/c/4e10a730d1b511ff49723371ed6d694dd1b2c785"
}
],
"title": "wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23315",
"datePublished": "2026-03-25T10:27:10.115Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:10.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23318 (GCVE-0-2026-23318)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
ALSA: usb-audio: Use correct version for UAC3 header validation
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Use correct version for UAC3 header validation
The entry of the validators table for UAC3 AC header descriptor is
defined with the wrong protocol version UAC_VERSION_2, while it should
have been UAC_VERSION_3. This results in the validator never matching
for actual UAC3 devices (protocol == UAC_VERSION_3), causing their
header descriptors to bypass validation entirely. A malicious USB
device presenting a truncated UAC3 header could exploit this to cause
out-of-bounds reads when the driver later accesses unvalidated
descriptor fields.
The bug was introduced in the same commit as the recently fixed UAC3
feature unit sub-type typo, and appears to be from the same copy-paste
error when the UAC3 section was created from the UAC2 section.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
57f8770620e9b51c61089751f0b5ad3dbe376ff2 , < 0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f
(git)
Affected: 57f8770620e9b51c61089751f0b5ad3dbe376ff2 , < a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc (git) Affected: 57f8770620e9b51c61089751f0b5ad3dbe376ff2 , < d3904ca40515272681ae61ad6f561c24f190957f (git) Affected: 57f8770620e9b51c61089751f0b5ad3dbe376ff2 , < 1e5753ff4c2e86aa88516f97a224c90a3d0b133e (git) Affected: 57f8770620e9b51c61089751f0b5ad3dbe376ff2 , < 499ffd15b00dc91ac95c28f76959dfb5cdcc84d5 (git) Affected: 57f8770620e9b51c61089751f0b5ad3dbe376ff2 , < 54f9d645a5453d0bfece0c465d34aaf072ea99fa (git) Affected: 17821e2fb16752f5d363fb5c3f8aab4df41b9bcc (git) Affected: bf74a46aebb1b5ab5e5f25bafa4ae0a453ba813a (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/validate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f",
"status": "affected",
"version": "57f8770620e9b51c61089751f0b5ad3dbe376ff2",
"versionType": "git"
},
{
"lessThan": "a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc",
"status": "affected",
"version": "57f8770620e9b51c61089751f0b5ad3dbe376ff2",
"versionType": "git"
},
{
"lessThan": "d3904ca40515272681ae61ad6f561c24f190957f",
"status": "affected",
"version": "57f8770620e9b51c61089751f0b5ad3dbe376ff2",
"versionType": "git"
},
{
"lessThan": "1e5753ff4c2e86aa88516f97a224c90a3d0b133e",
"status": "affected",
"version": "57f8770620e9b51c61089751f0b5ad3dbe376ff2",
"versionType": "git"
},
{
"lessThan": "499ffd15b00dc91ac95c28f76959dfb5cdcc84d5",
"status": "affected",
"version": "57f8770620e9b51c61089751f0b5ad3dbe376ff2",
"versionType": "git"
},
{
"lessThan": "54f9d645a5453d0bfece0c465d34aaf072ea99fa",
"status": "affected",
"version": "57f8770620e9b51c61089751f0b5ad3dbe376ff2",
"versionType": "git"
},
{
"status": "affected",
"version": "17821e2fb16752f5d363fb5c3f8aab4df41b9bcc",
"versionType": "git"
},
{
"status": "affected",
"version": "bf74a46aebb1b5ab5e5f25bafa4ae0a453ba813a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/validate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Use correct version for UAC3 header validation\n\nThe entry of the validators table for UAC3 AC header descriptor is\ndefined with the wrong protocol version UAC_VERSION_2, while it should\nhave been UAC_VERSION_3. This results in the validator never matching\nfor actual UAC3 devices (protocol == UAC_VERSION_3), causing their\nheader descriptors to bypass validation entirely. A malicious USB\ndevice presenting a truncated UAC3 header could exploit this to cause\nout-of-bounds reads when the driver later accesses unvalidated\ndescriptor fields.\n\nThe bug was introduced in the same commit as the recently fixed UAC3\nfeature unit sub-type typo, and appears to be from the same copy-paste\nerror when the UAC3 section was created from the UAC2 section."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:12.884Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0dcd1ed96c03459cf14706885c9dd3c1fd8bd29f"
},
{
"url": "https://git.kernel.org/stable/c/a0c6ae2ea84528f198bf7fd0117f12fd0cf6d7cc"
},
{
"url": "https://git.kernel.org/stable/c/d3904ca40515272681ae61ad6f561c24f190957f"
},
{
"url": "https://git.kernel.org/stable/c/1e5753ff4c2e86aa88516f97a224c90a3d0b133e"
},
{
"url": "https://git.kernel.org/stable/c/499ffd15b00dc91ac95c28f76959dfb5cdcc84d5"
},
{
"url": "https://git.kernel.org/stable/c/54f9d645a5453d0bfece0c465d34aaf072ea99fa"
}
],
"title": "ALSA: usb-audio: Use correct version for UAC3 header validation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23318",
"datePublished": "2026-03-25T10:27:12.884Z",
"dateReserved": "2026-01-13T15:37:45.995Z",
"dateUpdated": "2026-03-25T10:27:12.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23361 (GCVE-0-2026-23361)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X
interrupt to the host using a writel(), which generates a PCI posted write
transaction. There's no completion for posted writes, so the writel() may
return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also
unmaps the outbound ATU entry used for the PCI write, so the write races
with the unmap.
If the PCI write loses the race with the ATU unmap, the write may corrupt
host memory or cause IOMMU errors, e.g., these when running fio with a
larger queue depth against nvmet-pci-epf:
arm-smmu-v3 fc900000.iommu: 0x0000010000000010
arm-smmu-v3 fc900000.iommu: 0x0000020000000000
arm-smmu-v3 fc900000.iommu: 0x000000090000f040
arm-smmu-v3 fc900000.iommu: 0x0000000000000000
arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0
arm-smmu-v3 fc900000.iommu: unpriv data write s1 "Input address caused fault" stag: 0x0
Flush the write by performing a readl() of the same address to ensure that
the write has reached the destination before the ATU entry is unmapped.
The same problem was solved for dw_pcie_ep_raise_msi_irq() in commit
8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), but there
it was solved by dedicating an outbound iATU only for MSI. We can't do the
same for MSI-X because each vector can have a different msg_addr and the
msg_addr may be changed while the vector is masked.
[bhelgaas: commit log]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
beb4641a787df79a1423a8789d185b6b78fcbfea , < a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0
(git)
Affected: beb4641a787df79a1423a8789d185b6b78fcbfea , < 6f60a783860c77b309f7d81003b6a0c73feca49e (git) Affected: beb4641a787df79a1423a8789d185b6b78fcbfea , < eaa6a56801ddd2d9b4980f19e7fe002b00994804 (git) Affected: beb4641a787df79a1423a8789d185b6b78fcbfea , < c22533c66ccae10511ad6a7afc34bb26c47577e3 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/dwc/pcie-designware-ep.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0",
"status": "affected",
"version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
"versionType": "git"
},
{
"lessThan": "6f60a783860c77b309f7d81003b6a0c73feca49e",
"status": "affected",
"version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
"versionType": "git"
},
{
"lessThan": "eaa6a56801ddd2d9b4980f19e7fe002b00994804",
"status": "affected",
"version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
"versionType": "git"
},
{
"lessThan": "c22533c66ccae10511ad6a7afc34bb26c47577e3",
"status": "affected",
"version": "beb4641a787df79a1423a8789d185b6b78fcbfea",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/dwc/pcie-designware-ep.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry\n\nEndpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X\ninterrupt to the host using a writel(), which generates a PCI posted write\ntransaction. There\u0027s no completion for posted writes, so the writel() may\nreturn before the PCI write completes. dw_pcie_ep_raise_msix_irq() also\nunmaps the outbound ATU entry used for the PCI write, so the write races\nwith the unmap.\n\nIf the PCI write loses the race with the ATU unmap, the write may corrupt\nhost memory or cause IOMMU errors, e.g., these when running fio with a\nlarger queue depth against nvmet-pci-epf:\n\n arm-smmu-v3 fc900000.iommu: 0x0000010000000010\n arm-smmu-v3 fc900000.iommu: 0x0000020000000000\n arm-smmu-v3 fc900000.iommu: 0x000000090000f040\n arm-smmu-v3 fc900000.iommu: 0x0000000000000000\n arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0\n arm-smmu-v3 fc900000.iommu: unpriv data write s1 \"Input address caused fault\" stag: 0x0\n\nFlush the write by performing a readl() of the same address to ensure that\nthe write has reached the destination before the ATU entry is unmapped.\n\nThe same problem was solved for dw_pcie_ep_raise_msi_irq() in commit\n8719c64e76bf (\"PCI: dwc: ep: Cache MSI outbound iATU mapping\"), but there\nit was solved by dedicating an outbound iATU only for MSI. We can\u0027t do the\nsame for MSI-X because each vector can have a different msg_addr and the\nmsg_addr may be changed while the vector is masked.\n\n[bhelgaas: commit log]"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:44.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7afb8f810c04845fdfc58c57d9cf0cc5f23ced0"
},
{
"url": "https://git.kernel.org/stable/c/6f60a783860c77b309f7d81003b6a0c73feca49e"
},
{
"url": "https://git.kernel.org/stable/c/eaa6a56801ddd2d9b4980f19e7fe002b00994804"
},
{
"url": "https://git.kernel.org/stable/c/c22533c66ccae10511ad6a7afc34bb26c47577e3"
}
],
"title": "PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23361",
"datePublished": "2026-03-25T10:27:44.750Z",
"dateReserved": "2026-01-13T15:37:46.001Z",
"dateUpdated": "2026-03-25T10:27:44.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23356 (GCVE-0-2026-23356)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 16:49
VLAI?
EPSS
Title
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Summary
In the Linux kernel, the following vulnerability has been resolved:
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Even though we check that we "should" be able to do lc_get_cumulative()
while holding the device->al_lock spinlock, it may still fail,
if some other code path decided to do lc_try_lock() with bad timing.
If that happened, we logged "LOGIC BUG for enr=...",
but still did not return an error.
The rest of the code now assumed that this request has references
for the relevant activity log extents.
The implcations are that during an active resync, mutual exclusivity of
resync versus application IO is not guaranteed. And a potential crash
at this point may not realizs that these extents could have been target
of in-flight IO and would need to be resynced just in case.
Also, once the request completes, it will give up activity log references it
does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put().
Fix:
Do not crash the kernel for a condition that is harmless during normal
operation: also catch "e->refcnt == 0", not only "e == NULL"
when being noisy about "al_complete_io() called on inactive extent %u\n".
And do not try to be smart and "guess" whether something will work, then
be surprised when it does not.
Deal with the fact that it may or may not work. If it does not, remember a
possible "partially in activity log" state (only possible for requests that
cross extent boundaries), and return an error code from
drbd_al_begin_io_nonblock().
A latter call for the same request will then resume from where we left off.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 , < 7752569fc78e89794ce28946529850282233f99d
(git)
Affected: 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 , < e91d8d6565b7819d13dab21d4dbed5b45efba59b (git) Affected: 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 , < eef1390125b660b8b61f9f227a03bb9c5e6d36a5 (git) Affected: 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 , < d1ef3aed4df2ef1fe46befd8f2da9a6ec5445508 (git) Affected: 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 , < f558e5404a72054b525dced1a0c66aa95a144153 (git) Affected: 08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 , < ab140365fb62c0bdab22b2f516aff563b2559e3b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_actlog.c",
"drivers/block/drbd/drbd_interval.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7752569fc78e89794ce28946529850282233f99d",
"status": "affected",
"version": "08a1ddab6df7d3c7b6341774cb1cf4b21b96a214",
"versionType": "git"
},
{
"lessThan": "e91d8d6565b7819d13dab21d4dbed5b45efba59b",
"status": "affected",
"version": "08a1ddab6df7d3c7b6341774cb1cf4b21b96a214",
"versionType": "git"
},
{
"lessThan": "eef1390125b660b8b61f9f227a03bb9c5e6d36a5",
"status": "affected",
"version": "08a1ddab6df7d3c7b6341774cb1cf4b21b96a214",
"versionType": "git"
},
{
"lessThan": "d1ef3aed4df2ef1fe46befd8f2da9a6ec5445508",
"status": "affected",
"version": "08a1ddab6df7d3c7b6341774cb1cf4b21b96a214",
"versionType": "git"
},
{
"lessThan": "f558e5404a72054b525dced1a0c66aa95a144153",
"status": "affected",
"version": "08a1ddab6df7d3c7b6341774cb1cf4b21b96a214",
"versionType": "git"
},
{
"lessThan": "ab140365fb62c0bdab22b2f516aff563b2559e3b",
"status": "affected",
"version": "08a1ddab6df7d3c7b6341774cb1cf4b21b96a214",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_actlog.c",
"drivers/block/drbd/drbd_interval.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: fix \"LOGIC BUG\" in drbd_al_begin_io_nonblock()\n\nEven though we check that we \"should\" be able to do lc_get_cumulative()\nwhile holding the device-\u003eal_lock spinlock, it may still fail,\nif some other code path decided to do lc_try_lock() with bad timing.\n\nIf that happened, we logged \"LOGIC BUG for enr=...\",\nbut still did not return an error.\n\nThe rest of the code now assumed that this request has references\nfor the relevant activity log extents.\n\nThe implcations are that during an active resync, mutual exclusivity of\nresync versus application IO is not guaranteed. And a potential crash\nat this point may not realizs that these extents could have been target\nof in-flight IO and would need to be resynced just in case.\n\nAlso, once the request completes, it will give up activity log references it\ndoes not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put().\n\nFix:\n\nDo not crash the kernel for a condition that is harmless during normal\noperation: also catch \"e-\u003erefcnt == 0\", not only \"e == NULL\"\nwhen being noisy about \"al_complete_io() called on inactive extent %u\\n\".\n\nAnd do not try to be smart and \"guess\" whether something will work, then\nbe surprised when it does not.\nDeal with the fact that it may or may not work. If it does not, remember a\npossible \"partially in activity log\" state (only possible for requests that\ncross extent boundaries), and return an error code from\ndrbd_al_begin_io_nonblock().\n\nA latter call for the same request will then resume from where we left off."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:49:14.505Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7752569fc78e89794ce28946529850282233f99d"
},
{
"url": "https://git.kernel.org/stable/c/e91d8d6565b7819d13dab21d4dbed5b45efba59b"
},
{
"url": "https://git.kernel.org/stable/c/eef1390125b660b8b61f9f227a03bb9c5e6d36a5"
},
{
"url": "https://git.kernel.org/stable/c/d1ef3aed4df2ef1fe46befd8f2da9a6ec5445508"
},
{
"url": "https://git.kernel.org/stable/c/f558e5404a72054b525dced1a0c66aa95a144153"
},
{
"url": "https://git.kernel.org/stable/c/ab140365fb62c0bdab22b2f516aff563b2559e3b"
}
],
"title": "drbd: fix \"LOGIC BUG\" in drbd_al_begin_io_nonblock()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23356",
"datePublished": "2026-03-25T10:27:40.454Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T16:49:14.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23362 (GCVE-0-2026-23362)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
can: bcm: fix locking for bcm_op runtime updates
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix locking for bcm_op runtime updates
Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
added a locking for some variables that can be modified at runtime when
updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().
Usually the RX_SETUP only handles and filters incoming traffic with one
exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is
sent when a specific RTR frame is received. Therefore the rx bcm_op uses
bcm_can_tx() which uses the bcm_tx_lock that was only initialized in
bcm_tx_setup(). Add the missing spin_lock_init() when allocating the
bcm_op in bcm_rx_setup() to handle the RTR case properly.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
2a437b86ac5a9893c902f30ef66815bf13587bf6 , < 800f26f11ae37b17f58e0001f28a47dd75c26557
(git)
Affected: 76c84c3728178b2d38d5604e399dfe8b0752645e , < 70e951afad4c025261fe3c952d2b07237e320a01 (git) Affected: cc55dd28c20a6611e30596019b3b2f636819a4c0 , < 8bcf2d847adb82b2c617456f6da17ac5e6c75285 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < 8215ba7bc99e84e66fd6938874ec4330a9d96518 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < f0c349b2c21b220af5ba19f29b885e222958d796 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < c35636e91e392e1540949bbc67932167cb48bc3a (git) Affected: 8f1c022541bf5a923c8d6fa483112c15250f30a4 (git) Affected: 7595de7bc56e0e52b74e56c90f7e247bf626d628 (git) Affected: fbd8fdc2b218e979cfe422b139b8f74c12419d1f (git) Affected: c4e8a172501e677ebd8ea9d9161d97dc4df56fbd (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "800f26f11ae37b17f58e0001f28a47dd75c26557",
"status": "affected",
"version": "2a437b86ac5a9893c902f30ef66815bf13587bf6",
"versionType": "git"
},
{
"lessThan": "70e951afad4c025261fe3c952d2b07237e320a01",
"status": "affected",
"version": "76c84c3728178b2d38d5604e399dfe8b0752645e",
"versionType": "git"
},
{
"lessThan": "8bcf2d847adb82b2c617456f6da17ac5e6c75285",
"status": "affected",
"version": "cc55dd28c20a6611e30596019b3b2f636819a4c0",
"versionType": "git"
},
{
"lessThan": "8215ba7bc99e84e66fd6938874ec4330a9d96518",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"lessThan": "f0c349b2c21b220af5ba19f29b885e222958d796",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"lessThan": "c35636e91e392e1540949bbc67932167cb48bc3a",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"status": "affected",
"version": "8f1c022541bf5a923c8d6fa483112c15250f30a4",
"versionType": "git"
},
{
"status": "affected",
"version": "7595de7bc56e0e52b74e56c90f7e247bf626d628",
"versionType": "git"
},
{
"status": "affected",
"version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"versionType": "git"
},
{
"status": "affected",
"version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.12.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.294",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix locking for bcm_op runtime updates\n\nCommit c2aba69d0c36 (\"can: bcm: add locking for bcm_op runtime updates\")\nadded a locking for some variables that can be modified at runtime when\nupdating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().\n\nUsually the RX_SETUP only handles and filters incoming traffic with one\nexception: When the RX_RTR_FRAME flag is set a predefined CAN frame is\nsent when a specific RTR frame is received. Therefore the rx bcm_op uses\nbcm_can_tx() which uses the bcm_tx_lock that was only initialized in\nbcm_tx_setup(). Add the missing spin_lock_init() when allocating the\nbcm_op in bcm_rx_setup() to handle the RTR case properly."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:45.476Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/800f26f11ae37b17f58e0001f28a47dd75c26557"
},
{
"url": "https://git.kernel.org/stable/c/70e951afad4c025261fe3c952d2b07237e320a01"
},
{
"url": "https://git.kernel.org/stable/c/8bcf2d847adb82b2c617456f6da17ac5e6c75285"
},
{
"url": "https://git.kernel.org/stable/c/8215ba7bc99e84e66fd6938874ec4330a9d96518"
},
{
"url": "https://git.kernel.org/stable/c/f0c349b2c21b220af5ba19f29b885e222958d796"
},
{
"url": "https://git.kernel.org/stable/c/c35636e91e392e1540949bbc67932167cb48bc3a"
}
],
"title": "can: bcm: fix locking for bcm_op runtime updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23362",
"datePublished": "2026-03-25T10:27:45.476Z",
"dateReserved": "2026-01-13T15:37:46.002Z",
"dateUpdated": "2026-03-25T10:27:45.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23281 (GCVE-0-2026-23281)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
wifi: libertas: fix use-after-free in lbs_free_adapter()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix use-after-free in lbs_free_adapter()
The lbs_free_adapter() function uses timer_delete() (non-synchronous)
for both command_timer and tx_lockup_timer before the structure is
freed. This is incorrect because timer_delete() does not wait for
any running timer callback to complete.
If a timer callback is executing when lbs_free_adapter() is called,
the callback will access freed memory since lbs_cfg_free() frees the
containing structure immediately after lbs_free_adapter() returns.
Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
which would all be use-after-free violations.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
This bug was introduced in commit 8f641d93c38a ("libertas: detect TX
lockups and reset hardware") where del_timer() was used instead of
del_timer_sync() in the cleanup path. The command_timer has had the
same issue since the driver was first written.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
954ee164f4f4598afc172c0ec3865d0352e55a0b , < 3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc
(git)
Affected: 954ee164f4f4598afc172c0ec3865d0352e55a0b , < 3c5c818c78b03a1725f3dcd566865c77b48dd3a6 (git) Affected: 954ee164f4f4598afc172c0ec3865d0352e55a0b , < d0155fe68f31b339961cf2d4f92937d57e9384e6 (git) Affected: 954ee164f4f4598afc172c0ec3865d0352e55a0b , < ed7d30f90b77f73a47498686ede83f622b7e4f0d (git) Affected: 954ee164f4f4598afc172c0ec3865d0352e55a0b , < a9f55b14486426d907459bced5825a25063bd922 (git) Affected: 954ee164f4f4598afc172c0ec3865d0352e55a0b , < 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc",
"status": "affected",
"version": "954ee164f4f4598afc172c0ec3865d0352e55a0b",
"versionType": "git"
},
{
"lessThan": "3c5c818c78b03a1725f3dcd566865c77b48dd3a6",
"status": "affected",
"version": "954ee164f4f4598afc172c0ec3865d0352e55a0b",
"versionType": "git"
},
{
"lessThan": "d0155fe68f31b339961cf2d4f92937d57e9384e6",
"status": "affected",
"version": "954ee164f4f4598afc172c0ec3865d0352e55a0b",
"versionType": "git"
},
{
"lessThan": "ed7d30f90b77f73a47498686ede83f622b7e4f0d",
"status": "affected",
"version": "954ee164f4f4598afc172c0ec3865d0352e55a0b",
"versionType": "git"
},
{
"lessThan": "a9f55b14486426d907459bced5825a25063bd922",
"status": "affected",
"version": "954ee164f4f4598afc172c0ec3865d0352e55a0b",
"versionType": "git"
},
{
"lessThan": "03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0",
"status": "affected",
"version": "954ee164f4f4598afc172c0ec3865d0352e55a0b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix use-after-free in lbs_free_adapter()\n\nThe lbs_free_adapter() function uses timer_delete() (non-synchronous)\nfor both command_timer and tx_lockup_timer before the structure is\nfreed. This is incorrect because timer_delete() does not wait for\nany running timer callback to complete.\n\nIf a timer callback is executing when lbs_free_adapter() is called,\nthe callback will access freed memory since lbs_cfg_free() frees the\ncontaining structure immediately after lbs_free_adapter() returns.\n\nBoth timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)\naccess priv-\u003edriver_lock, priv-\u003ecur_cmd, priv-\u003edev, and other fields,\nwhich would all be use-after-free violations.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.\n\nThis bug was introduced in commit 8f641d93c38a (\"libertas: detect TX\nlockups and reset hardware\") where del_timer() was used instead of\ndel_timer_sync() in the cleanup path. The command_timer has had the\nsame issue since the driver was first written."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:41.844Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3f9dec4a6d95d7f1f5e9e9dfdfa173c053bba8dc"
},
{
"url": "https://git.kernel.org/stable/c/3c5c818c78b03a1725f3dcd566865c77b48dd3a6"
},
{
"url": "https://git.kernel.org/stable/c/d0155fe68f31b339961cf2d4f92937d57e9384e6"
},
{
"url": "https://git.kernel.org/stable/c/ed7d30f90b77f73a47498686ede83f622b7e4f0d"
},
{
"url": "https://git.kernel.org/stable/c/a9f55b14486426d907459bced5825a25063bd922"
},
{
"url": "https://git.kernel.org/stable/c/03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0"
}
],
"title": "wifi: libertas: fix use-after-free in lbs_free_adapter()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23281",
"datePublished": "2026-03-25T10:26:41.844Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:41.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23301 (GCVE-0-2026-23301)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
ASoC: SDCA: Add allocation failure check for Entity name
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SDCA: Add allocation failure check for Entity name
Currently find_sdca_entity_iot() can allocate a string for the
Entity name but it doesn't check if that allocation succeeded.
Add the missing NULL check after the allocation.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sdca/sdca_functions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdcc10a86055beb7109a786d94abf5626f375bbd",
"status": "affected",
"version": "48fa77af2f4a55ab961520f2a0e50560dc0baca8",
"versionType": "git"
},
{
"lessThan": "27990181031fdcdbe0f7c46011f6404e5d116386",
"status": "affected",
"version": "48fa77af2f4a55ab961520f2a0e50560dc0baca8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sdca/sdca_functions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Add allocation failure check for Entity name\n\nCurrently find_sdca_entity_iot() can allocate a string for the\nEntity name but it doesn\u0027t check if that allocation succeeded.\nAdd the missing NULL check after the allocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:56.830Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdcc10a86055beb7109a786d94abf5626f375bbd"
},
{
"url": "https://git.kernel.org/stable/c/27990181031fdcdbe0f7c46011f6404e5d116386"
}
],
"title": "ASoC: SDCA: Add allocation failure check for Entity name",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23301",
"datePublished": "2026-03-25T10:26:56.830Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:56.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23289 (GCVE-0-2026-23289)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
Fix a user triggerable leak on the system call failure path.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
ec34a922d243c3401a694450734e9effb2bafbfe , < f67f1ad4029e9fa183141546de31987b254c9292
(git)
Affected: ec34a922d243c3401a694450734e9effb2bafbfe , < d0148965dbca8cc8efa7e3d6e99940487bf661c0 (git) Affected: ec34a922d243c3401a694450734e9effb2bafbfe , < da8eaa73bc37d004350ba68eb18b6ade8e49db52 (git) Affected: ec34a922d243c3401a694450734e9effb2bafbfe , < deee46b37ebd8cc5ff810127883fca90f2412a7b (git) Affected: ec34a922d243c3401a694450734e9effb2bafbfe , < 972b72d7e2d8fe1400f1c7a8304c282c539b7e02 (git) Affected: ec34a922d243c3401a694450734e9effb2bafbfe , < 117942ca43e2e3c3d121faae530989931b7f67e1 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mthca/mthca_provider.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f67f1ad4029e9fa183141546de31987b254c9292",
"status": "affected",
"version": "ec34a922d243c3401a694450734e9effb2bafbfe",
"versionType": "git"
},
{
"lessThan": "d0148965dbca8cc8efa7e3d6e99940487bf661c0",
"status": "affected",
"version": "ec34a922d243c3401a694450734e9effb2bafbfe",
"versionType": "git"
},
{
"lessThan": "da8eaa73bc37d004350ba68eb18b6ade8e49db52",
"status": "affected",
"version": "ec34a922d243c3401a694450734e9effb2bafbfe",
"versionType": "git"
},
{
"lessThan": "deee46b37ebd8cc5ff810127883fca90f2412a7b",
"status": "affected",
"version": "ec34a922d243c3401a694450734e9effb2bafbfe",
"versionType": "git"
},
{
"lessThan": "972b72d7e2d8fe1400f1c7a8304c282c539b7e02",
"status": "affected",
"version": "ec34a922d243c3401a694450734e9effb2bafbfe",
"versionType": "git"
},
{
"lessThan": "117942ca43e2e3c3d121faae530989931b7f67e1",
"status": "affected",
"version": "ec34a922d243c3401a694450734e9effb2bafbfe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mthca/mthca_provider.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()\n\nFix a user triggerable leak on the system call failure path."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:48.207Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f67f1ad4029e9fa183141546de31987b254c9292"
},
{
"url": "https://git.kernel.org/stable/c/d0148965dbca8cc8efa7e3d6e99940487bf661c0"
},
{
"url": "https://git.kernel.org/stable/c/da8eaa73bc37d004350ba68eb18b6ade8e49db52"
},
{
"url": "https://git.kernel.org/stable/c/deee46b37ebd8cc5ff810127883fca90f2412a7b"
},
{
"url": "https://git.kernel.org/stable/c/972b72d7e2d8fe1400f1c7a8304c282c539b7e02"
},
{
"url": "https://git.kernel.org/stable/c/117942ca43e2e3c3d121faae530989931b7f67e1"
}
],
"title": "IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23289",
"datePublished": "2026-03-25T10:26:48.207Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:48.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23344 (GCVE-0-2026-23344)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
crypto: ccp - Fix use-after-free on error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Fix use-after-free on error path
In the error path of sev_tsm_init_locked(), the code dereferences 't'
after it has been freed with kfree(). The pr_err() statement attempts
to access t->tio_en and t->tio_init_done after the memory has been
released.
Move the pr_err() call before kfree(t) to access the fields while the
memory is still valid.
This issue reported by Smatch static analyser
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/sev-dev-tsm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79a26fe3175b9ed7c0c9541b197cb9786237c0f7",
"status": "affected",
"version": "4be423572da1f4c11f45168e3fafda870ddac9f8",
"versionType": "git"
},
{
"lessThan": "889b0e2721e793eb46cf7d17b965aa3252af3ec8",
"status": "affected",
"version": "4be423572da1f4c11f45168e3fafda870ddac9f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/sev-dev-tsm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix use-after-free on error path\n\nIn the error path of sev_tsm_init_locked(), the code dereferences \u0027t\u0027\nafter it has been freed with kfree(). The pr_err() statement attempts\nto access t-\u003etio_en and t-\u003etio_init_done after the memory has been\nreleased.\n\nMove the pr_err() call before kfree(t) to access the fields while the\nmemory is still valid.\n\nThis issue reported by Smatch static analyser"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:31.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79a26fe3175b9ed7c0c9541b197cb9786237c0f7"
},
{
"url": "https://git.kernel.org/stable/c/889b0e2721e793eb46cf7d17b965aa3252af3ec8"
}
],
"title": "crypto: ccp - Fix use-after-free on error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23344",
"datePublished": "2026-03-25T10:27:31.795Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:31.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23373 (GCVE-0-2026-23373)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
This triggers a WARN_ON in ieee80211_hw_conf_init and isn't the expected
behavior from the driver - other drivers default to 0 too.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
0a44dfc070749514b804ccac0b1fd38718f7daa1 , < b64fbd718cf42feb75502bf25d0d16eb671aea45
(git)
Affected: 0a44dfc070749514b804ccac0b1fd38718f7daa1 , < 95ed07644b2c6119f706484b87b7f43e6133f3b5 (git) Affected: 0a44dfc070749514b804ccac0b1fd38718f7daa1 , < 67d10e8db57ffc21f8177e9e884bbc743fdc0bae (git) Affected: 0a44dfc070749514b804ccac0b1fd38718f7daa1 , < d973b1039ccde6b241b438d53297edce4de45b5c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/rsi/rsi_91x_mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b64fbd718cf42feb75502bf25d0d16eb671aea45",
"status": "affected",
"version": "0a44dfc070749514b804ccac0b1fd38718f7daa1",
"versionType": "git"
},
{
"lessThan": "95ed07644b2c6119f706484b87b7f43e6133f3b5",
"status": "affected",
"version": "0a44dfc070749514b804ccac0b1fd38718f7daa1",
"versionType": "git"
},
{
"lessThan": "67d10e8db57ffc21f8177e9e884bbc743fdc0bae",
"status": "affected",
"version": "0a44dfc070749514b804ccac0b1fd38718f7daa1",
"versionType": "git"
},
{
"lessThan": "d973b1039ccde6b241b438d53297edce4de45b5c",
"status": "affected",
"version": "0a44dfc070749514b804ccac0b1fd38718f7daa1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/rsi/rsi_91x_mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: Don\u0027t default to -EOPNOTSUPP in rsi_mac80211_config\n\nThis triggers a WARN_ON in ieee80211_hw_conf_init and isn\u0027t the expected\nbehavior from the driver - other drivers default to 0 too."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:54.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b64fbd718cf42feb75502bf25d0d16eb671aea45"
},
{
"url": "https://git.kernel.org/stable/c/95ed07644b2c6119f706484b87b7f43e6133f3b5"
},
{
"url": "https://git.kernel.org/stable/c/67d10e8db57ffc21f8177e9e884bbc743fdc0bae"
},
{
"url": "https://git.kernel.org/stable/c/d973b1039ccde6b241b438d53297edce4de45b5c"
}
],
"title": "wifi: rsi: Don\u0027t default to -EOPNOTSUPP in rsi_mac80211_config",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23373",
"datePublished": "2026-03-25T10:27:54.155Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:54.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23342 (GCVE-0-2026-23342)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
bpf: Fix race in cpumap on PREEMPT_RT
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix race in cpumap on PREEMPT_RT
On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed
concurrently by multiple preemptible tasks on the same CPU.
The original code assumes bq_enqueue() and __cpu_map_flush() run
atomically with respect to each other on the same CPU, relying on
local_bh_disable() to prevent preemption. However, on PREEMPT_RT,
local_bh_disable() only calls migrate_disable() (when
PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable
preemption, which allows CFS scheduling to preempt a task during
bq_flush_to_queue(), enabling another task on the same CPU to enter
bq_enqueue() and operate on the same per-CPU bq concurrently.
This leads to several races:
1. Double __list_del_clearprev(): after bq->count is reset in
bq_flush_to_queue(), a preempting task can call bq_enqueue() ->
bq_flush_to_queue() on the same bq when bq->count reaches
CPU_MAP_BULK_SIZE. Both tasks then call __list_del_clearprev()
on the same bq->flush_node, the second call dereferences the
prev pointer that was already set to NULL by the first.
2. bq->count and bq->q[] races: concurrent bq_enqueue() can corrupt
the packet queue while bq_flush_to_queue() is processing it.
The race between task A (__cpu_map_flush -> bq_flush_to_queue) and
task B (bq_enqueue -> bq_flush_to_queue) on the same CPU:
Task A (xdp_do_flush) Task B (cpu_map_enqueue)
---------------------- ------------------------
bq_flush_to_queue(bq)
spin_lock(&q->producer_lock)
/* flush bq->q[] to ptr_ring */
bq->count = 0
spin_unlock(&q->producer_lock)
bq_enqueue(rcpu, xdpf)
<-- CFS preempts Task A --> bq->q[bq->count++] = xdpf
/* ... more enqueues until full ... */
bq_flush_to_queue(bq)
spin_lock(&q->producer_lock)
/* flush to ptr_ring */
spin_unlock(&q->producer_lock)
__list_del_clearprev(flush_node)
/* sets flush_node.prev = NULL */
<-- Task A resumes -->
__list_del_clearprev(flush_node)
flush_node.prev->next = ...
/* prev is NULL -> kernel oops */
Fix this by adding a local_lock_t to xdp_bulk_queue and acquiring it
in bq_enqueue() and __cpu_map_flush(). These paths already run under
local_bh_disable(), so use local_lock_nested_bh() which on non-RT is
a pure annotation with no overhead, and on PREEMPT_RT provides a
per-CPU sleeping lock that serializes access to the bq.
To reproduce, insert an mdelay(100) between bq->count = 0 and
__list_del_clearprev() in bq_flush_to_queue(), then run reproducer
provided by syzkaller.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3253cb49cbad4772389d6ef55be75db1f97da910 , < 7466ae2aeed483de80c5d8dea0913cf74038b652
(git)
Affected: 3253cb49cbad4772389d6ef55be75db1f97da910 , < e67299e1044349ad0088d52c6bc5764cc1816c06 (git) Affected: 3253cb49cbad4772389d6ef55be75db1f97da910 , < 869c63d5975d55e97f6b168e885452b3da20ea47 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/cpumap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7466ae2aeed483de80c5d8dea0913cf74038b652",
"status": "affected",
"version": "3253cb49cbad4772389d6ef55be75db1f97da910",
"versionType": "git"
},
{
"lessThan": "e67299e1044349ad0088d52c6bc5764cc1816c06",
"status": "affected",
"version": "3253cb49cbad4772389d6ef55be75db1f97da910",
"versionType": "git"
},
{
"lessThan": "869c63d5975d55e97f6b168e885452b3da20ea47",
"status": "affected",
"version": "3253cb49cbad4772389d6ef55be75db1f97da910",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/cpumap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix race in cpumap on PREEMPT_RT\n\nOn PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed\nconcurrently by multiple preemptible tasks on the same CPU.\n\nThe original code assumes bq_enqueue() and __cpu_map_flush() run\natomically with respect to each other on the same CPU, relying on\nlocal_bh_disable() to prevent preemption. However, on PREEMPT_RT,\nlocal_bh_disable() only calls migrate_disable() (when\nPREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable\npreemption, which allows CFS scheduling to preempt a task during\nbq_flush_to_queue(), enabling another task on the same CPU to enter\nbq_enqueue() and operate on the same per-CPU bq concurrently.\n\nThis leads to several races:\n\n1. Double __list_del_clearprev(): after bq-\u003ecount is reset in\n bq_flush_to_queue(), a preempting task can call bq_enqueue() -\u003e\n bq_flush_to_queue() on the same bq when bq-\u003ecount reaches\n CPU_MAP_BULK_SIZE. Both tasks then call __list_del_clearprev()\n on the same bq-\u003eflush_node, the second call dereferences the\n prev pointer that was already set to NULL by the first.\n\n2. bq-\u003ecount and bq-\u003eq[] races: concurrent bq_enqueue() can corrupt\n the packet queue while bq_flush_to_queue() is processing it.\n\nThe race between task A (__cpu_map_flush -\u003e bq_flush_to_queue) and\ntask B (bq_enqueue -\u003e bq_flush_to_queue) on the same CPU:\n\n Task A (xdp_do_flush) Task B (cpu_map_enqueue)\n ---------------------- ------------------------\n bq_flush_to_queue(bq)\n spin_lock(\u0026q-\u003eproducer_lock)\n /* flush bq-\u003eq[] to ptr_ring */\n bq-\u003ecount = 0\n spin_unlock(\u0026q-\u003eproducer_lock)\n bq_enqueue(rcpu, xdpf)\n \u003c-- CFS preempts Task A --\u003e bq-\u003eq[bq-\u003ecount++] = xdpf\n /* ... more enqueues until full ... */\n bq_flush_to_queue(bq)\n spin_lock(\u0026q-\u003eproducer_lock)\n /* flush to ptr_ring */\n spin_unlock(\u0026q-\u003eproducer_lock)\n __list_del_clearprev(flush_node)\n /* sets flush_node.prev = NULL */\n \u003c-- Task A resumes --\u003e\n __list_del_clearprev(flush_node)\n flush_node.prev-\u003enext = ...\n /* prev is NULL -\u003e kernel oops */\n\nFix this by adding a local_lock_t to xdp_bulk_queue and acquiring it\nin bq_enqueue() and __cpu_map_flush(). These paths already run under\nlocal_bh_disable(), so use local_lock_nested_bh() which on non-RT is\na pure annotation with no overhead, and on PREEMPT_RT provides a\nper-CPU sleeping lock that serializes access to the bq.\n\nTo reproduce, insert an mdelay(100) between bq-\u003ecount = 0 and\n__list_del_clearprev() in bq_flush_to_queue(), then run reproducer\nprovided by syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:30.285Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7466ae2aeed483de80c5d8dea0913cf74038b652"
},
{
"url": "https://git.kernel.org/stable/c/e67299e1044349ad0088d52c6bc5764cc1816c06"
},
{
"url": "https://git.kernel.org/stable/c/869c63d5975d55e97f6b168e885452b3da20ea47"
}
],
"title": "bpf: Fix race in cpumap on PREEMPT_RT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23342",
"datePublished": "2026-03-25T10:27:30.285Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:30.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23295 (GCVE-0-2026-23295)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
accel/amdxdna: Fix dead lock for suspend and resume
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix dead lock for suspend and resume
When an application issues a query IOCTL while auto suspend is running,
a deadlock can occur. The query path holds dev_lock and then calls
pm_runtime_resume_and_get(), which waits for the ongoing suspend to
complete. Meanwhile, the suspend callback attempts to acquire dev_lock
and blocks, resulting in a deadlock.
Fix this by releasing dev_lock before calling pm_runtime_resume_and_get()
and reacquiring it after the call completes. Also acquire dev_lock in the
resume callback to keep the locking consistent.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_ctx.c",
"drivers/accel/amdxdna/aie2_pci.c",
"drivers/accel/amdxdna/aie2_pm.c",
"drivers/accel/amdxdna/amdxdna_ctx.c",
"drivers/accel/amdxdna/amdxdna_pm.c",
"drivers/accel/amdxdna/amdxdna_pm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac24537478dd8eb2fd3984b4652bb19461e5e74c",
"status": "affected",
"version": "063db451832b8849faf1b0b8404b3a6a39995b29",
"versionType": "git"
},
{
"lessThan": "1aa82181a3c285c7351523d587f7981ae4c015c8",
"status": "affected",
"version": "063db451832b8849faf1b0b8404b3a6a39995b29",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_ctx.c",
"drivers/accel/amdxdna/aie2_pci.c",
"drivers/accel/amdxdna/aie2_pm.c",
"drivers/accel/amdxdna/amdxdna_ctx.c",
"drivers/accel/amdxdna/amdxdna_pm.c",
"drivers/accel/amdxdna/amdxdna_pm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix dead lock for suspend and resume\n\nWhen an application issues a query IOCTL while auto suspend is running,\na deadlock can occur. The query path holds dev_lock and then calls\npm_runtime_resume_and_get(), which waits for the ongoing suspend to\ncomplete. Meanwhile, the suspend callback attempts to acquire dev_lock\nand blocks, resulting in a deadlock.\n\nFix this by releasing dev_lock before calling pm_runtime_resume_and_get()\nand reacquiring it after the call completes. Also acquire dev_lock in the\nresume callback to keep the locking consistent."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:52.789Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac24537478dd8eb2fd3984b4652bb19461e5e74c"
},
{
"url": "https://git.kernel.org/stable/c/1aa82181a3c285c7351523d587f7981ae4c015c8"
}
],
"title": "accel/amdxdna: Fix dead lock for suspend and resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23295",
"datePublished": "2026-03-25T10:26:52.789Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:52.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23328 (GCVE-0-2026-23328)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
mgmt_chann may be set to NULL if the firmware returns an unexpected
error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL
pointer dereference in aie2_hw_stop().
Fix this by introducing a dedicated helper to destroy mgmt_chann
and by adding proper NULL checks before accessing it.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c",
"drivers/accel/amdxdna/aie2_pci.c",
"drivers/accel/amdxdna/aie2_pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "032ca7a9059c4ba6c329e0f1b442dab54dd9c3e5",
"status": "affected",
"version": "b87f920b934426a24d54613f12ed67c03ae05024",
"versionType": "git"
},
{
"lessThan": "6270ee26e1edd862ea17e3eba148ca8fb2c99dc9",
"status": "affected",
"version": "b87f920b934426a24d54613f12ed67c03ae05024",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c",
"drivers/accel/amdxdna/aie2_pci.c",
"drivers/accel/amdxdna/aie2_pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix NULL pointer dereference of mgmt_chann\n\nmgmt_chann may be set to NULL if the firmware returns an unexpected\nerror in aie2_send_mgmt_msg_wait(). This can later lead to a NULL\npointer dereference in aie2_hw_stop().\n\nFix this by introducing a dedicated helper to destroy mgmt_chann\nand by adding proper NULL checks before accessing it."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:20.559Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/032ca7a9059c4ba6c329e0f1b442dab54dd9c3e5"
},
{
"url": "https://git.kernel.org/stable/c/6270ee26e1edd862ea17e3eba148ca8fb2c99dc9"
}
],
"title": "accel/amdxdna: Fix NULL pointer dereference of mgmt_chann",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23328",
"datePublished": "2026-03-25T10:27:20.559Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:20.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23282 (GCVE-0-2026-23282)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
smb: client: fix oops due to uninitialised var in smb2_unlink()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix oops due to uninitialised var in smb2_unlink()
If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the
iovs set @rqst will be left uninitialised, hence calling
SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will
oops.
Fix this by initialising @close_iov and @open_iov before setting them
in @rqst.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
1cf9f2a6a544288516a7b9e883a48eba6246bcf2 , < 86163b98891aa9800f6103252e5acc7bb98afb91
(git)
Affected: 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 , < dc710c87af3341554d02d634ada1d2036c49a94a (git) Affected: 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 , < 048efe129a297256d3c2088cf8d79515ff5ec864 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86163b98891aa9800f6103252e5acc7bb98afb91",
"status": "affected",
"version": "1cf9f2a6a544288516a7b9e883a48eba6246bcf2",
"versionType": "git"
},
{
"lessThan": "dc710c87af3341554d02d634ada1d2036c49a94a",
"status": "affected",
"version": "1cf9f2a6a544288516a7b9e883a48eba6246bcf2",
"versionType": "git"
},
{
"lessThan": "048efe129a297256d3c2088cf8d79515ff5ec864",
"status": "affected",
"version": "1cf9f2a6a544288516a7b9e883a48eba6246bcf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix oops due to uninitialised var in smb2_unlink()\n\nIf SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the\niovs set @rqst will be left uninitialised, hence calling\nSMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will\noops.\n\nFix this by initialising @close_iov and @open_iov before setting them\nin @rqst."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:42.495Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86163b98891aa9800f6103252e5acc7bb98afb91"
},
{
"url": "https://git.kernel.org/stable/c/dc710c87af3341554d02d634ada1d2036c49a94a"
},
{
"url": "https://git.kernel.org/stable/c/048efe129a297256d3c2088cf8d79515ff5ec864"
}
],
"title": "smb: client: fix oops due to uninitialised var in smb2_unlink()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23282",
"datePublished": "2026-03-25T10:26:42.495Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:42.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23367 (GCVE-0-2026-23367)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
wifi: radiotap: reject radiotap with unknown bits
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: radiotap: reject radiotap with unknown bits
The radiotap parser is currently only used with the radiotap
namespace (not with vendor namespaces), but if the undefined
field 18 is used, the alignment/size is unknown as well. In
this case, iterator->_next_ns_data isn't initialized (it's
only set for skipping vendor namespaces), and syzbot points
out that we later compare against this uninitialized value.
Fix this by moving the rejection of unknown radiotap fields
down to after the in-namespace lookup, so it will really use
iterator->_next_ns_data only for vendor namespaces, even in
case undefined fields are present.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 703fa979badbba83d31cd011606d060bfb8b0d1d
(git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 129c8bb320a7cef692c78056ef8e89a2a12ba448 (git) Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 2a60c588d5d39ad187628f58395c776a97fd4323 (git) Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 2f8ceeba670610d66f77def32011f48de951d781 (git) Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < e664971759a0e5570b50c6592e58a7f97d55e992 (git) Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/radiotap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "703fa979badbba83d31cd011606d060bfb8b0d1d",
"status": "affected",
"version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
"versionType": "git"
},
{
"lessThan": "129c8bb320a7cef692c78056ef8e89a2a12ba448",
"status": "affected",
"version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
"versionType": "git"
},
{
"lessThan": "2a60c588d5d39ad187628f58395c776a97fd4323",
"status": "affected",
"version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
"versionType": "git"
},
{
"lessThan": "2f8ceeba670610d66f77def32011f48de951d781",
"status": "affected",
"version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
"versionType": "git"
},
{
"lessThan": "e664971759a0e5570b50c6592e58a7f97d55e992",
"status": "affected",
"version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
"versionType": "git"
},
{
"lessThan": "c854758abe0b8d86f9c43dc060ff56a0ee5b31e0",
"status": "affected",
"version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/radiotap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: radiotap: reject radiotap with unknown bits\n\nThe radiotap parser is currently only used with the radiotap\nnamespace (not with vendor namespaces), but if the undefined\nfield 18 is used, the alignment/size is unknown as well. In\nthis case, iterator-\u003e_next_ns_data isn\u0027t initialized (it\u0027s\nonly set for skipping vendor namespaces), and syzbot points\nout that we later compare against this uninitialized value.\n\nFix this by moving the rejection of unknown radiotap fields\ndown to after the in-namespace lookup, so it will really use\niterator-\u003e_next_ns_data only for vendor namespaces, even in\ncase undefined fields are present."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:49.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/703fa979badbba83d31cd011606d060bfb8b0d1d"
},
{
"url": "https://git.kernel.org/stable/c/129c8bb320a7cef692c78056ef8e89a2a12ba448"
},
{
"url": "https://git.kernel.org/stable/c/2a60c588d5d39ad187628f58395c776a97fd4323"
},
{
"url": "https://git.kernel.org/stable/c/2f8ceeba670610d66f77def32011f48de951d781"
},
{
"url": "https://git.kernel.org/stable/c/e664971759a0e5570b50c6592e58a7f97d55e992"
},
{
"url": "https://git.kernel.org/stable/c/c854758abe0b8d86f9c43dc060ff56a0ee5b31e0"
}
],
"title": "wifi: radiotap: reject radiotap with unknown bits",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23367",
"datePublished": "2026-03-25T10:27:49.068Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:49.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23311 (GCVE-0-2026-23311)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
perf/core: Fix invalid wait context in ctx_sched_in()
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix invalid wait context in ctx_sched_in()
Lockdep found a bug in the event scheduling when a pinned event was
failed and wakes up the threads in the ring buffer like below.
It seems it should not grab a wait-queue lock under perf-context lock.
Let's do it with irq_work.
[ 39.913691] =============================
[ 39.914157] [ BUG: Invalid wait context ]
[ 39.914623] 6.15.0-next-20250530-next-2025053 #1 Not tainted
[ 39.915271] -----------------------------
[ 39.915731] repro/837 is trying to lock:
[ 39.916191] ffff88801acfabd8 (&event->waitq){....}-{3:3}, at: __wake_up+0x26/0x60
[ 39.917182] other info that might help us debug this:
[ 39.917761] context-{5:5}
[ 39.918079] 4 locks held by repro/837:
[ 39.918530] #0: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: __perf_event_task_sched_in+0xd1/0xbc0
[ 39.919612] #1: ffff88806ca3c6f8 (&cpuctx_lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1a7/0xbc0
[ 39.920748] #2: ffff88800d91fc18 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1f9/0xbc0
[ 39.921819] #3: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: perf_event_wakeup+0x6c/0x470
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
f4b07fd62d4d11d57a15cb4ae01b3833282eb8f6 , < c67ab059953e3b66cb17ddd6524c23f9e1f6526d
(git)
Affected: f4b07fd62d4d11d57a15cb4ae01b3833282eb8f6 , < 825f218ca70ef394c2b8546b313711d867b24584 (git) Affected: f4b07fd62d4d11d57a15cb4ae01b3833282eb8f6 , < 486ff5ad49bc50315bcaf6d45f04a33ef0a45ced (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c67ab059953e3b66cb17ddd6524c23f9e1f6526d",
"status": "affected",
"version": "f4b07fd62d4d11d57a15cb4ae01b3833282eb8f6",
"versionType": "git"
},
{
"lessThan": "825f218ca70ef394c2b8546b313711d867b24584",
"status": "affected",
"version": "f4b07fd62d4d11d57a15cb4ae01b3833282eb8f6",
"versionType": "git"
},
{
"lessThan": "486ff5ad49bc50315bcaf6d45f04a33ef0a45ced",
"status": "affected",
"version": "f4b07fd62d4d11d57a15cb4ae01b3833282eb8f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix invalid wait context in ctx_sched_in()\n\nLockdep found a bug in the event scheduling when a pinned event was\nfailed and wakes up the threads in the ring buffer like below.\n\nIt seems it should not grab a wait-queue lock under perf-context lock.\nLet\u0027s do it with irq_work.\n\n [ 39.913691] =============================\n [ 39.914157] [ BUG: Invalid wait context ]\n [ 39.914623] 6.15.0-next-20250530-next-2025053 #1 Not tainted\n [ 39.915271] -----------------------------\n [ 39.915731] repro/837 is trying to lock:\n [ 39.916191] ffff88801acfabd8 (\u0026event-\u003ewaitq){....}-{3:3}, at: __wake_up+0x26/0x60\n [ 39.917182] other info that might help us debug this:\n [ 39.917761] context-{5:5}\n [ 39.918079] 4 locks held by repro/837:\n [ 39.918530] #0: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: __perf_event_task_sched_in+0xd1/0xbc0\n [ 39.919612] #1: ffff88806ca3c6f8 (\u0026cpuctx_lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1a7/0xbc0\n [ 39.920748] #2: ffff88800d91fc18 (\u0026ctx-\u003elock){....}-{2:2}, at: __perf_event_task_sched_in+0x1f9/0xbc0\n [ 39.921819] #3: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: perf_event_wakeup+0x6c/0x470"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:06.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c67ab059953e3b66cb17ddd6524c23f9e1f6526d"
},
{
"url": "https://git.kernel.org/stable/c/825f218ca70ef394c2b8546b313711d867b24584"
},
{
"url": "https://git.kernel.org/stable/c/486ff5ad49bc50315bcaf6d45f04a33ef0a45ced"
}
],
"title": "perf/core: Fix invalid wait context in ctx_sched_in()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23311",
"datePublished": "2026-03-25T10:27:06.915Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:06.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23285 (GCVE-0-2026-23285)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 16:49
VLAI?
EPSS
Title
drbd: fix null-pointer dereference on local read error
Summary
In the Linux kernel, the following vulnerability has been resolved:
drbd: fix null-pointer dereference on local read error
In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to
__req_mod() with a NULL peer_device:
__req_mod(req, what, NULL, &m);
The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this
NULL peer_device to drbd_set_out_of_sync(), which dereferences it,
causing a null-pointer dereference.
Fix this by obtaining the peer_device via first_peer_device(device),
matching how drbd_req_destroy() handles the same situation.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
0d11f3cf279c5ad20a41f29242f170ba3c02f2da , < 6f1d1614f841d91a4169db65812ffd1271735b42
(git)
Affected: 0d11f3cf279c5ad20a41f29242f170ba3c02f2da , < 1e906c08594c8f9a6a524f38ede2c4e051196106 (git) Affected: 0d11f3cf279c5ad20a41f29242f170ba3c02f2da , < 4e8935053ba389ae8d6685c10854d8021931bd89 (git) Affected: 0d11f3cf279c5ad20a41f29242f170ba3c02f2da , < 91df51d2df0ca4fd3281f73626341563d64a98a5 (git) Affected: 0d11f3cf279c5ad20a41f29242f170ba3c02f2da , < 0d195d3b205ca90db30d70d09d7bb6909aac178f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_req.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6f1d1614f841d91a4169db65812ffd1271735b42",
"status": "affected",
"version": "0d11f3cf279c5ad20a41f29242f170ba3c02f2da",
"versionType": "git"
},
{
"lessThan": "1e906c08594c8f9a6a524f38ede2c4e051196106",
"status": "affected",
"version": "0d11f3cf279c5ad20a41f29242f170ba3c02f2da",
"versionType": "git"
},
{
"lessThan": "4e8935053ba389ae8d6685c10854d8021931bd89",
"status": "affected",
"version": "0d11f3cf279c5ad20a41f29242f170ba3c02f2da",
"versionType": "git"
},
{
"lessThan": "91df51d2df0ca4fd3281f73626341563d64a98a5",
"status": "affected",
"version": "0d11f3cf279c5ad20a41f29242f170ba3c02f2da",
"versionType": "git"
},
{
"lessThan": "0d195d3b205ca90db30d70d09d7bb6909aac178f",
"status": "affected",
"version": "0d11f3cf279c5ad20a41f29242f170ba3c02f2da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_req.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: fix null-pointer dereference on local read error\n\nIn drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to\n__req_mod() with a NULL peer_device:\n\n __req_mod(req, what, NULL, \u0026m);\n\nThe READ_COMPLETED_WITH_ERROR handler then unconditionally passes this\nNULL peer_device to drbd_set_out_of_sync(), which dereferences it,\ncausing a null-pointer dereference.\n\nFix this by obtaining the peer_device via first_peer_device(device),\nmatching how drbd_req_destroy() handles the same situation."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:49:09.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6f1d1614f841d91a4169db65812ffd1271735b42"
},
{
"url": "https://git.kernel.org/stable/c/1e906c08594c8f9a6a524f38ede2c4e051196106"
},
{
"url": "https://git.kernel.org/stable/c/4e8935053ba389ae8d6685c10854d8021931bd89"
},
{
"url": "https://git.kernel.org/stable/c/91df51d2df0ca4fd3281f73626341563d64a98a5"
},
{
"url": "https://git.kernel.org/stable/c/0d195d3b205ca90db30d70d09d7bb6909aac178f"
}
],
"title": "drbd: fix null-pointer dereference on local read error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23285",
"datePublished": "2026-03-25T10:26:44.698Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T16:49:09.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23288 (GCVE-0-2026-23288)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
accel/amdxdna: Fix out-of-bounds memset in command slot handling
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix out-of-bounds memset in command slot handling
The remaining space in a command slot may be smaller than the size of
the command header. Clearing the command header with memset() before
verifying the available slot space can result in an out-of-bounds write
and memory corruption.
Fix this by moving the memset() call after the size validation.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cca770d710d5e03bc814af585cd6975eb6d74074",
"status": "affected",
"version": "13ae1a6000f7d8b09478e3128e87d45e89c7282f",
"versionType": "git"
},
{
"lessThan": "1110a949675ebd56b3f0286e664ea543f745801c",
"status": "affected",
"version": "3d32eb7a5ecff92d83a5fd34c45c171c17d3d5d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0-rc1"
},
{
"lessThan": "7.0-rc1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "7.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix out-of-bounds memset in command slot handling\n\nThe remaining space in a command slot may be smaller than the size of\nthe command header. Clearing the command header with memset() before\nverifying the available slot space can result in an out-of-bounds write\nand memory corruption.\n\nFix this by moving the memset() call after the size validation."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:47.458Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cca770d710d5e03bc814af585cd6975eb6d74074"
},
{
"url": "https://git.kernel.org/stable/c/1110a949675ebd56b3f0286e664ea543f745801c"
}
],
"title": "accel/amdxdna: Fix out-of-bounds memset in command slot handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23288",
"datePublished": "2026-03-25T10:26:47.458Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:47.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23326 (GCVE-0-2026-23326)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
xsk: Fix fragment node deletion to prevent buffer leak
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"),
the list_node field is reused for both the xskb pool list and the buffer
free list, this causes a buffer leak as described below.
xp_free() checks if a buffer is already on the free list using
list_empty(&xskb->list_node). When list_del() is used to remove a node
from the xskb pool list, it doesn't reinitialize the node pointers.
This means list_empty() will return false even after the node has been
removed, causing xp_free() to incorrectly skip adding the buffer to the
free list.
Fix this by using list_del_init() instead of list_del() in all fragment
handling paths, this ensures the list node is reinitialized after removal,
allowing the list_empty() to work correctly.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
560c974b7ccd95bb9ff20df77f6654283e45c9c6 , < 5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d
(git)
Affected: fd5614763805d6f386bd07cc53558f88b1b1eb62 , < 2a9ea988465ece5b6896b1bdc144170a64e84c35 (git) Affected: b692bf9a7543af7ad11a59d182a3757578f0ba53 , < 645c6d8376ad4913cbffe0e0c2cca0c4febbe596 (git) Affected: b692bf9a7543af7ad11a59d182a3757578f0ba53 , < b38cbd4af5034635cff109e08788c63f956f3a69 (git) Affected: b692bf9a7543af7ad11a59d182a3757578f0ba53 , < 60abb0ac11dccd6b98fd9182bc5f85b621688861 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock_drv.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d",
"status": "affected",
"version": "560c974b7ccd95bb9ff20df77f6654283e45c9c6",
"versionType": "git"
},
{
"lessThan": "2a9ea988465ece5b6896b1bdc144170a64e84c35",
"status": "affected",
"version": "fd5614763805d6f386bd07cc53558f88b1b1eb62",
"versionType": "git"
},
{
"lessThan": "645c6d8376ad4913cbffe0e0c2cca0c4febbe596",
"status": "affected",
"version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
"versionType": "git"
},
{
"lessThan": "b38cbd4af5034635cff109e08788c63f956f3a69",
"status": "affected",
"version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
"versionType": "git"
},
{
"lessThan": "60abb0ac11dccd6b98fd9182bc5f85b621688861",
"status": "affected",
"version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock_drv.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix fragment node deletion to prevent buffer leak\n\nAfter commit b692bf9a7543 (\"xsk: Get rid of xdp_buff_xsk::xskb_list_node\"),\nthe list_node field is reused for both the xskb pool list and the buffer\nfree list, this causes a buffer leak as described below.\n\nxp_free() checks if a buffer is already on the free list using\nlist_empty(\u0026xskb-\u003elist_node). When list_del() is used to remove a node\nfrom the xskb pool list, it doesn\u0027t reinitialize the node pointers.\nThis means list_empty() will return false even after the node has been\nremoved, causing xp_free() to incorrectly skip adding the buffer to the\nfree list.\n\nFix this by using list_del_init() instead of list_del() in all fragment\nhandling paths, this ensures the list node is reinitialized after removal,\nallowing the list_empty() to work correctly."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:19.021Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d"
},
{
"url": "https://git.kernel.org/stable/c/2a9ea988465ece5b6896b1bdc144170a64e84c35"
},
{
"url": "https://git.kernel.org/stable/c/645c6d8376ad4913cbffe0e0c2cca0c4febbe596"
},
{
"url": "https://git.kernel.org/stable/c/b38cbd4af5034635cff109e08788c63f956f3a69"
},
{
"url": "https://git.kernel.org/stable/c/60abb0ac11dccd6b98fd9182bc5f85b621688861"
}
],
"title": "xsk: Fix fragment node deletion to prevent buffer leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23326",
"datePublished": "2026-03-25T10:27:19.021Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-03-25T10:27:19.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23357 (GCVE-0-2026-23357)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
can: mcp251x: fix deadlock in error path of mcp251x_open
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: mcp251x: fix deadlock in error path of mcp251x_open
The mcp251x_open() function call free_irq() in its error path with the
mpc_lock mutex held. But if an interrupt already occurred the
interrupt handler will be waiting for the mpc_lock and free_irq() will
deadlock waiting for the handler to finish.
This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can:
mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but
for the error path.
To solve this issue move the call to free_irq() after the lock is
released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ
handler will exit right away once it acquired the lock.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
bf66f3736a945dd4e92d86427276c6eeab0a6c1d , < 256f0cff6e946c570392bda1d01a65e789a7afd0
(git)
Affected: bf66f3736a945dd4e92d86427276c6eeab0a6c1d , < b73832292cd914e87a55e863ba4413a907e7db6b (git) Affected: bf66f3736a945dd4e92d86427276c6eeab0a6c1d , < 38063cc435b69d56e76f947c10d336fcb2953508 (git) Affected: bf66f3736a945dd4e92d86427276c6eeab0a6c1d , < d27f12c3f5e85efc479896af4a69eccb37f75e8e (git) Affected: bf66f3736a945dd4e92d86427276c6eeab0a6c1d , < e728f444c913a91d290d1824b4770780bbd6378e (git) Affected: bf66f3736a945dd4e92d86427276c6eeab0a6c1d , < ab3f894de216f4a62adc3b57e9191888cbf26885 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/spi/mcp251x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "256f0cff6e946c570392bda1d01a65e789a7afd0",
"status": "affected",
"version": "bf66f3736a945dd4e92d86427276c6eeab0a6c1d",
"versionType": "git"
},
{
"lessThan": "b73832292cd914e87a55e863ba4413a907e7db6b",
"status": "affected",
"version": "bf66f3736a945dd4e92d86427276c6eeab0a6c1d",
"versionType": "git"
},
{
"lessThan": "38063cc435b69d56e76f947c10d336fcb2953508",
"status": "affected",
"version": "bf66f3736a945dd4e92d86427276c6eeab0a6c1d",
"versionType": "git"
},
{
"lessThan": "d27f12c3f5e85efc479896af4a69eccb37f75e8e",
"status": "affected",
"version": "bf66f3736a945dd4e92d86427276c6eeab0a6c1d",
"versionType": "git"
},
{
"lessThan": "e728f444c913a91d290d1824b4770780bbd6378e",
"status": "affected",
"version": "bf66f3736a945dd4e92d86427276c6eeab0a6c1d",
"versionType": "git"
},
{
"lessThan": "ab3f894de216f4a62adc3b57e9191888cbf26885",
"status": "affected",
"version": "bf66f3736a945dd4e92d86427276c6eeab0a6c1d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/spi/mcp251x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcp251x: fix deadlock in error path of mcp251x_open\n\nThe mcp251x_open() function call free_irq() in its error path with the\nmpc_lock mutex held. But if an interrupt already occurred the\ninterrupt handler will be waiting for the mpc_lock and free_irq() will\ndeadlock waiting for the handler to finish.\n\nThis issue is similar to the one fixed in commit 7dd9c26bd6cf (\"can:\nmcp251x: fix deadlock if an interrupt occurs during mcp251x_open\") but\nfor the error path.\n\nTo solve this issue move the call to free_irq() after the lock is\nreleased. Setting `priv-\u003eforce_quit = 1` beforehand ensure that the IRQ\nhandler will exit right away once it acquired the lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:41.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/256f0cff6e946c570392bda1d01a65e789a7afd0"
},
{
"url": "https://git.kernel.org/stable/c/b73832292cd914e87a55e863ba4413a907e7db6b"
},
{
"url": "https://git.kernel.org/stable/c/38063cc435b69d56e76f947c10d336fcb2953508"
},
{
"url": "https://git.kernel.org/stable/c/d27f12c3f5e85efc479896af4a69eccb37f75e8e"
},
{
"url": "https://git.kernel.org/stable/c/e728f444c913a91d290d1824b4770780bbd6378e"
},
{
"url": "https://git.kernel.org/stable/c/ab3f894de216f4a62adc3b57e9191888cbf26885"
}
],
"title": "can: mcp251x: fix deadlock in error path of mcp251x_open",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23357",
"datePublished": "2026-03-25T10:27:41.299Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:41.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23377 (GCVE-0-2026-23377)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
The only user of frag_size field in XDP RxQ info is
bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead
of DMA write size. Different assumptions in ice driver configuration lead
to negative tailroom.
This allows to trigger kernel panic, when using
XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to
6912 and the requested offset to a huge value, e.g.
XSK_UMEM__MAX_FRAME_SIZE * 100.
Due to other quirks of the ZC configuration in ice, panic is not observed
in ZC mode, but tailroom growing still fails when it should not.
Use fill queue buffer truesize instead of DMA write size in XDP RxQ info.
Fix ZC mode too by using the new helper.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b0f05100e8795aadd1c0606bae9caefbda070d63",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
},
{
"lessThan": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:57.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b0f05100e8795aadd1c0606bae9caefbda070d63"
},
{
"url": "https://git.kernel.org/stable/c/e142dc4ef0f451b7ef99d09aaa84e9389af629d7"
}
],
"title": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23377",
"datePublished": "2026-03-25T10:27:57.338Z",
"dateReserved": "2026-01-13T15:37:46.006Z",
"dateUpdated": "2026-03-25T10:27:57.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23300 (GCVE-0-2026-23300)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
When a standalone IPv6 nexthop object is created with a loopback device
(e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies
it as a reject route. This is because nexthop objects have no destination
prefix (fc_dst=::), causing fib6_is_reject() to match any loopback
nexthop. The reject path skips fib_nh_common_init(), leaving
nhc_pcpu_rth_output unallocated. If an IPv4 route later references this
nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and
panics.
Simplify the check in fib6_nh_init() to only match explicit reject
routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback
promotion heuristic in fib6_is_reject() is handled separately by
ip6_route_info_create_nh(). After this change, the three cases behave
as follows:
1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"):
RTF_REJECT is set, enters reject path, skips fib_nh_common_init().
No behavior change.
2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"):
RTF_REJECT is not set, takes normal path, fib_nh_common_init() is
called. ip6_route_info_create_nh() still promotes it to reject
afterward. nhc_pcpu_rth_output is allocated but unused, which is
harmless.
3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"):
RTF_REJECT is not set, takes normal path, fib_nh_common_init() is
called. nhc_pcpu_rth_output is properly allocated, fixing the crash
when IPv4 routes reference this nexthop.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
493ced1ac47c48bb86d9d4e8e87df8592be85a0e , < b5062fc2150614c9ea8a611c2e0cb6e047ebfa3a
(git)
Affected: 493ced1ac47c48bb86d9d4e8e87df8592be85a0e , < b299121e7453d23faddf464087dff513a495b4fc (git) Affected: 493ced1ac47c48bb86d9d4e8e87df8592be85a0e , < f7c9f8e3607440fe39300efbaf46cf7b5eecb23f (git) Affected: 493ced1ac47c48bb86d9d4e8e87df8592be85a0e , < b3b5a037d520afe3d5276e653bc0ff516bbda34c (git) Affected: 493ced1ac47c48bb86d9d4e8e87df8592be85a0e , < 8650db85b4259d2885d2a80fbc2317ce24194133 (git) Affected: 493ced1ac47c48bb86d9d4e8e87df8592be85a0e , < 21ec92774d1536f71bdc90b0e3d052eff99cf093 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5062fc2150614c9ea8a611c2e0cb6e047ebfa3a",
"status": "affected",
"version": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"versionType": "git"
},
{
"lessThan": "b299121e7453d23faddf464087dff513a495b4fc",
"status": "affected",
"version": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"versionType": "git"
},
{
"lessThan": "f7c9f8e3607440fe39300efbaf46cf7b5eecb23f",
"status": "affected",
"version": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"versionType": "git"
},
{
"lessThan": "b3b5a037d520afe3d5276e653bc0ff516bbda34c",
"status": "affected",
"version": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"versionType": "git"
},
{
"lessThan": "8650db85b4259d2885d2a80fbc2317ce24194133",
"status": "affected",
"version": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"versionType": "git"
},
{
"lessThan": "21ec92774d1536f71bdc90b0e3d052eff99cf093",
"status": "affected",
"version": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n\nWhen a standalone IPv6 nexthop object is created with a loopback device\n(e.g., \"ip -6 nexthop add id 100 dev lo\"), fib6_nh_init() misclassifies\nit as a reject route. This is because nexthop objects have no destination\nprefix (fc_dst=::), causing fib6_is_reject() to match any loopback\nnexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. If an IPv4 route later references this\nnexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and\npanics.\n\nSimplify the check in fib6_nh_init() to only match explicit reject\nroutes (RTF_REJECT) instead of using fib6_is_reject(). The loopback\npromotion heuristic in fib6_is_reject() is handled separately by\nip6_route_info_create_nh(). After this change, the three cases behave\nas follows:\n\n1. Explicit reject route (\"ip -6 route add unreachable 2001:db8::/64\"):\n RTF_REJECT is set, enters reject path, skips fib_nh_common_init().\n No behavior change.\n\n2. Implicit loopback reject route (\"ip -6 route add 2001:db8::/32 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. ip6_route_info_create_nh() still promotes it to reject\n afterward. nhc_pcpu_rth_output is allocated but unused, which is\n harmless.\n\n3. Standalone nexthop object (\"ip -6 nexthop add id 100 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. nhc_pcpu_rth_output is properly allocated, fixing the crash\n when IPv4 routes reference this nexthop."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:56.138Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5062fc2150614c9ea8a611c2e0cb6e047ebfa3a"
},
{
"url": "https://git.kernel.org/stable/c/b299121e7453d23faddf464087dff513a495b4fc"
},
{
"url": "https://git.kernel.org/stable/c/f7c9f8e3607440fe39300efbaf46cf7b5eecb23f"
},
{
"url": "https://git.kernel.org/stable/c/b3b5a037d520afe3d5276e653bc0ff516bbda34c"
},
{
"url": "https://git.kernel.org/stable/c/8650db85b4259d2885d2a80fbc2317ce24194133"
},
{
"url": "https://git.kernel.org/stable/c/21ec92774d1536f71bdc90b0e3d052eff99cf093"
}
],
"title": "net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23300",
"datePublished": "2026-03-25T10:26:56.138Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-03-25T10:26:56.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23381 (GCVE-0-2026-23381)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits before ndisc_init() is called
which initializes it. Then, if neigh_suppress is enabled and an ICMPv6
Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will
dereference ipv6_stub->nd_tbl which is NULL, passing it to
neigh_lookup(). This causes a kernel NULL pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000268
Oops: 0000 [#1] PREEMPT SMP NOPTI
[...]
RIP: 0010:neigh_lookup+0x16/0xe0
[...]
Call Trace:
<IRQ>
? neigh_lookup+0x16/0xe0
br_do_suppress_nd+0x160/0x290 [bridge]
br_handle_frame_finish+0x500/0x620 [bridge]
br_handle_frame+0x353/0x440 [bridge]
__netif_receive_skb_core.constprop.0+0x298/0x1110
__netif_receive_skb_one_core+0x3d/0xa0
process_backlog+0xa0/0x140
__napi_poll+0x2c/0x170
net_rx_action+0x2c4/0x3a0
handle_softirqs+0xd0/0x270
do_softirq+0x3f/0x60
Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in
the callers. This is in essence disabling NS/NA suppression when IPv6 is
disabled.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
ed842faeb2bd49256f00485402f3113205f91d30 , < 7a894eb5de246d79f13105c55a67381039a24d44
(git)
Affected: ed842faeb2bd49256f00485402f3113205f91d30 , < a12cdaa3375f0bd3c8f4e564be7c143529abfe5b (git) Affected: ed842faeb2bd49256f00485402f3113205f91d30 , < aa73deb3b6b730ec280d45b3f423bfa9e17bc122 (git) Affected: ed842faeb2bd49256f00485402f3113205f91d30 , < 33dec6f10777d5a8f71c0a200f690da5ae3c2e55 (git) Affected: ed842faeb2bd49256f00485402f3113205f91d30 , < 20ef5c25422f97dd09d751e5ae6c18406cdc78e6 (git) Affected: ed842faeb2bd49256f00485402f3113205f91d30 , < e5e890630533bdc15b26a34bb8e7ef539bdf1322 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_device.c",
"net/bridge/br_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a894eb5de246d79f13105c55a67381039a24d44",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "a12cdaa3375f0bd3c8f4e564be7c143529abfe5b",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "aa73deb3b6b730ec280d45b3f423bfa9e17bc122",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "33dec6f10777d5a8f71c0a200f690da5ae3c2e55",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "20ef5c25422f97dd09d751e5ae6c18406cdc78e6",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "e5e890630533bdc15b26a34bb8e7ef539bdf1322",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_device.c",
"net/bridge/br_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable=1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. Then, if neigh_suppress is enabled and an ICMPv6\nNeighbor Discovery packet reaches the bridge, br_do_suppress_nd() will\ndereference ipv6_stub-\u003end_tbl which is NULL, passing it to\nneigh_lookup(). This causes a kernel NULL pointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000268\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x16/0xe0\n [...]\n Call Trace:\n \u003cIRQ\u003e\n ? neigh_lookup+0x16/0xe0\n br_do_suppress_nd+0x160/0x290 [bridge]\n br_handle_frame_finish+0x500/0x620 [bridge]\n br_handle_frame+0x353/0x440 [bridge]\n __netif_receive_skb_core.constprop.0+0x298/0x1110\n __netif_receive_skb_one_core+0x3d/0xa0\n process_backlog+0xa0/0x140\n __napi_poll+0x2c/0x170\n net_rx_action+0x2c4/0x3a0\n handle_softirqs+0xd0/0x270\n do_softirq+0x3f/0x60\n\nFix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in\nthe callers. This is in essence disabling NS/NA suppression when IPv6 is\ndisabled."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:00.416Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a894eb5de246d79f13105c55a67381039a24d44"
},
{
"url": "https://git.kernel.org/stable/c/a12cdaa3375f0bd3c8f4e564be7c143529abfe5b"
},
{
"url": "https://git.kernel.org/stable/c/aa73deb3b6b730ec280d45b3f423bfa9e17bc122"
},
{
"url": "https://git.kernel.org/stable/c/33dec6f10777d5a8f71c0a200f690da5ae3c2e55"
},
{
"url": "https://git.kernel.org/stable/c/20ef5c25422f97dd09d751e5ae6c18406cdc78e6"
},
{
"url": "https://git.kernel.org/stable/c/e5e890630533bdc15b26a34bb8e7ef539bdf1322"
}
],
"title": "net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23381",
"datePublished": "2026-03-25T10:28:00.416Z",
"dateReserved": "2026-01-13T15:37:46.007Z",
"dateUpdated": "2026-03-25T10:28:00.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23336 (GCVE-0-2026-23336)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
There is a use-after-free error in cfg80211_shutdown_all_interfaces found
by syzkaller:
BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220
Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326
CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: events cfg80211_rfkill_block_work
Call Trace:
<TASK>
dump_stack_lvl+0x116/0x1f0
print_report+0xcd/0x630
kasan_report+0xe0/0x110
cfg80211_shutdown_all_interfaces+0x213/0x220
cfg80211_rfkill_block_work+0x1e/0x30
process_one_work+0x9cf/0x1b70
worker_thread+0x6c8/0xf10
kthread+0x3c5/0x780
ret_from_fork+0x56d/0x700
ret_from_fork_asm+0x1a/0x30
</TASK>
The problem arises due to the rfkill_block work is not cancelled when wiphy
is being unregistered. In order to fix the issue cancel the corresponding
work in wiphy_unregister().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 , < eeea8da43ab86ac0a6b9cec225eec91564346940
(git)
Affected: 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 , < fa18639deab4a3662d543200c5bfc29bf4e23173 (git) Affected: 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 , < 57e39fe8da573435fa35975f414f4dc17d9f8449 (git) Affected: 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 , < 584279ad9ff1e8e7c5494b9fce286201f7d1f9e2 (git) Affected: 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 , < cd2f52944c7b95dcdfe0d87f385a2d96458a3ae5 (git) Affected: 1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3 , < 767d23ade706d5fa51c36168e92a9c5533c351a1 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eeea8da43ab86ac0a6b9cec225eec91564346940",
"status": "affected",
"version": "1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3",
"versionType": "git"
},
{
"lessThan": "fa18639deab4a3662d543200c5bfc29bf4e23173",
"status": "affected",
"version": "1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3",
"versionType": "git"
},
{
"lessThan": "57e39fe8da573435fa35975f414f4dc17d9f8449",
"status": "affected",
"version": "1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3",
"versionType": "git"
},
{
"lessThan": "584279ad9ff1e8e7c5494b9fce286201f7d1f9e2",
"status": "affected",
"version": "1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3",
"versionType": "git"
},
{
"lessThan": "cd2f52944c7b95dcdfe0d87f385a2d96458a3ae5",
"status": "affected",
"version": "1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3",
"versionType": "git"
},
{
"lessThan": "767d23ade706d5fa51c36168e92a9c5533c351a1",
"status": "affected",
"version": "1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel rfkill_block work in wiphy_unregister()\n\nThere is a use-after-free error in cfg80211_shutdown_all_interfaces found\nby syzkaller:\n\nBUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220\nRead of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326\nCPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nWorkqueue: events cfg80211_rfkill_block_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x116/0x1f0\n print_report+0xcd/0x630\n kasan_report+0xe0/0x110\n cfg80211_shutdown_all_interfaces+0x213/0x220\n cfg80211_rfkill_block_work+0x1e/0x30\n process_one_work+0x9cf/0x1b70\n worker_thread+0x6c8/0xf10\n kthread+0x3c5/0x780\n ret_from_fork+0x56d/0x700\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nThe problem arises due to the rfkill_block work is not cancelled when wiphy\nis being unregistered. In order to fix the issue cancel the corresponding\nwork in wiphy_unregister().\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:26.061Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eeea8da43ab86ac0a6b9cec225eec91564346940"
},
{
"url": "https://git.kernel.org/stable/c/fa18639deab4a3662d543200c5bfc29bf4e23173"
},
{
"url": "https://git.kernel.org/stable/c/57e39fe8da573435fa35975f414f4dc17d9f8449"
},
{
"url": "https://git.kernel.org/stable/c/584279ad9ff1e8e7c5494b9fce286201f7d1f9e2"
},
{
"url": "https://git.kernel.org/stable/c/cd2f52944c7b95dcdfe0d87f385a2d96458a3ae5"
},
{
"url": "https://git.kernel.org/stable/c/767d23ade706d5fa51c36168e92a9c5533c351a1"
}
],
"title": "wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23336",
"datePublished": "2026-03-25T10:27:26.061Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:26.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23287 (GCVE-0-2026-23287)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
Summary
In the Linux kernel, the following vulnerability has been resolved:
irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
PLIC ignores interrupt completion message for disabled interrupt, explained
by the specification:
The PLIC signals it has completed executing an interrupt handler by
writing the interrupt ID it received from the claim to the
claim/complete register. The PLIC does not check whether the completion
ID is the same as the last claim ID for that target. If the completion
ID does not match an interrupt source that is currently enabled for
the target, the completion is silently ignored.
This caused problems in the past, because an interrupt can be disabled
while still being handled and plic_irq_eoi() had no effect. That was fixed
by checking if the interrupt is disabled, and if so enable it, before
sending the completion message. That check is done with irqd_irq_disabled().
However, that is not sufficient because the enable bit for the handling
hart can be zero despite irqd_irq_disabled(d) being false. This can happen
when affinity setting is changed while a hart is still handling the
interrupt.
This problem is easily reproducible by dumping a large file to uart (which
generates lots of interrupts) and at the same time keep changing the uart
interrupt's affinity setting. The uart port becomes frozen almost
instantaneously.
Fix this by checking PLIC's enable bit instead of irqd_irq_disabled().
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
cc9f04f9a84f745949e325661550ed14bd0ff322 , < 8942fb1a5bc2dcbd88f7e656d109d42f778f298f
(git)
Affected: cc9f04f9a84f745949e325661550ed14bd0ff322 , < 2edbd173309165d103be6c73bd83e459dc45ae7b (git) Affected: cc9f04f9a84f745949e325661550ed14bd0ff322 , < 686eb378a4a51aa967e08337dd59daade16aec0f (git) Affected: cc9f04f9a84f745949e325661550ed14bd0ff322 , < 1883332bf21feb8871af09daf604fc4836a76925 (git) Affected: cc9f04f9a84f745949e325661550ed14bd0ff322 , < f611791a927141d05d7030607dea6372311c1413 (git) Affected: cc9f04f9a84f745949e325661550ed14bd0ff322 , < 1072020685f4b81f6efad3b412cdae0bd62bb043 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/irqchip/irq-sifive-plic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8942fb1a5bc2dcbd88f7e656d109d42f778f298f",
"status": "affected",
"version": "cc9f04f9a84f745949e325661550ed14bd0ff322",
"versionType": "git"
},
{
"lessThan": "2edbd173309165d103be6c73bd83e459dc45ae7b",
"status": "affected",
"version": "cc9f04f9a84f745949e325661550ed14bd0ff322",
"versionType": "git"
},
{
"lessThan": "686eb378a4a51aa967e08337dd59daade16aec0f",
"status": "affected",
"version": "cc9f04f9a84f745949e325661550ed14bd0ff322",
"versionType": "git"
},
{
"lessThan": "1883332bf21feb8871af09daf604fc4836a76925",
"status": "affected",
"version": "cc9f04f9a84f745949e325661550ed14bd0ff322",
"versionType": "git"
},
{
"lessThan": "f611791a927141d05d7030607dea6372311c1413",
"status": "affected",
"version": "cc9f04f9a84f745949e325661550ed14bd0ff322",
"versionType": "git"
},
{
"lessThan": "1072020685f4b81f6efad3b412cdae0bd62bb043",
"status": "affected",
"version": "cc9f04f9a84f745949e325661550ed14bd0ff322",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/irqchip/irq-sifive-plic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/sifive-plic: Fix frozen interrupt due to affinity setting\n\nPLIC ignores interrupt completion message for disabled interrupt, explained\nby the specification:\n\n The PLIC signals it has completed executing an interrupt handler by\n writing the interrupt ID it received from the claim to the\n claim/complete register. The PLIC does not check whether the completion\n ID is the same as the last claim ID for that target. If the completion\n ID does not match an interrupt source that is currently enabled for\n the target, the completion is silently ignored.\n\nThis caused problems in the past, because an interrupt can be disabled\nwhile still being handled and plic_irq_eoi() had no effect. That was fixed\nby checking if the interrupt is disabled, and if so enable it, before\nsending the completion message. That check is done with irqd_irq_disabled().\n\nHowever, that is not sufficient because the enable bit for the handling\nhart can be zero despite irqd_irq_disabled(d) being false. This can happen\nwhen affinity setting is changed while a hart is still handling the\ninterrupt.\n\nThis problem is easily reproducible by dumping a large file to uart (which\ngenerates lots of interrupts) and at the same time keep changing the uart\ninterrupt\u0027s affinity setting. The uart port becomes frozen almost\ninstantaneously.\n\nFix this by checking PLIC\u0027s enable bit instead of irqd_irq_disabled()."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:46.363Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8942fb1a5bc2dcbd88f7e656d109d42f778f298f"
},
{
"url": "https://git.kernel.org/stable/c/2edbd173309165d103be6c73bd83e459dc45ae7b"
},
{
"url": "https://git.kernel.org/stable/c/686eb378a4a51aa967e08337dd59daade16aec0f"
},
{
"url": "https://git.kernel.org/stable/c/1883332bf21feb8871af09daf604fc4836a76925"
},
{
"url": "https://git.kernel.org/stable/c/f611791a927141d05d7030607dea6372311c1413"
},
{
"url": "https://git.kernel.org/stable/c/1072020685f4b81f6efad3b412cdae0bd62bb043"
}
],
"title": "irqchip/sifive-plic: Fix frozen interrupt due to affinity setting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23287",
"datePublished": "2026-03-25T10:26:46.363Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:46.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23310 (GCVE-0-2026-23310)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
bond_option_mode_set() already rejects mode changes that would make a
loaded XDP program incompatible via bond_xdp_check(). However,
bond_option_xmit_hash_policy_set() has no such guard.
For 802.3ad and balance-xor modes, bond_xdp_check() returns false when
xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually
absent due to hardware offload. This means a user can:
1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode
with a compatible xmit_hash_policy (e.g. layer2+3).
2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.
This leaves bond->xdp_prog set but bond_xdp_check() now returning false
for the same device. When the bond is later destroyed, dev_xdp_uninstall()
calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits
the bond_xdp_check() guard and returns -EOPNOTSUPP, triggering:
WARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))
Fix this by rejecting xmit_hash_policy changes to vlan+srcmac when an
XDP program is loaded on a bond in 802.3ad or balance-xor mode.
commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP")
introduced bond_xdp_check() which returns false for 802.3ad/balance-xor
modes when xmit_hash_policy is vlan+srcmac. The check was wired into
bond_xdp_set() to reject XDP attachment with an incompatible policy, but
the symmetric path -- preventing xmit_hash_policy from being changed to an
incompatible value after XDP is already loaded -- was left unguarded in
bond_option_xmit_hash_policy_set().
Note:
commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode")
later added a similar guard to bond_option_mode_set(), but
bond_option_xmit_hash_policy_set() remained unprotected.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 5c262bd0e39320a6d6c8277cb8349ce21c01b8c1
(git)
Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < d36ad7e126c6a0c5f699583309ccc37e3a3263ea (git) Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e (git) Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < e85fa809e507b9d8eff4840888b8c727e4e8448c (git) Affected: 39a0876d595bd7c7512782dfcce0ee66f65bf221 , < 479d589b40b836442bbdadc3fdb37f001bb67f26 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c",
"drivers/net/bonding/bond_options.c",
"include/net/bonding.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c262bd0e39320a6d6c8277cb8349ce21c01b8c1",
"status": "affected",
"version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
"versionType": "git"
},
{
"lessThan": "d36ad7e126c6a0c5f699583309ccc37e3a3263ea",
"status": "affected",
"version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
"versionType": "git"
},
{
"lessThan": "0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e",
"status": "affected",
"version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
"versionType": "git"
},
{
"lessThan": "e85fa809e507b9d8eff4840888b8c727e4e8448c",
"status": "affected",
"version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
"versionType": "git"
},
{
"lessThan": "479d589b40b836442bbdadc3fdb37f001bb67f26",
"status": "affected",
"version": "39a0876d595bd7c7512782dfcce0ee66f65bf221",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c",
"drivers/net/bonding/bond_options.c",
"include/net/bonding.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded\n\nbond_option_mode_set() already rejects mode changes that would make a\nloaded XDP program incompatible via bond_xdp_check(). However,\nbond_option_xmit_hash_policy_set() has no such guard.\n\nFor 802.3ad and balance-xor modes, bond_xdp_check() returns false when\nxmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually\nabsent due to hardware offload. This means a user can:\n\n1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode\n with a compatible xmit_hash_policy (e.g. layer2+3).\n2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.\n\nThis leaves bond-\u003exdp_prog set but bond_xdp_check() now returning false\nfor the same device. When the bond is later destroyed, dev_xdp_uninstall()\ncalls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits\nthe bond_xdp_check() guard and returns -EOPNOTSUPP, triggering:\n\nWARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))\n\nFix this by rejecting xmit_hash_policy changes to vlan+srcmac when an\nXDP program is loaded on a bond in 802.3ad or balance-xor mode.\n\ncommit 39a0876d595b (\"net, bonding: Disallow vlan+srcmac with XDP\")\nintroduced bond_xdp_check() which returns false for 802.3ad/balance-xor\nmodes when xmit_hash_policy is vlan+srcmac. The check was wired into\nbond_xdp_set() to reject XDP attachment with an incompatible policy, but\nthe symmetric path -- preventing xmit_hash_policy from being changed to an\nincompatible value after XDP is already loaded -- was left unguarded in\nbond_option_xmit_hash_policy_set().\n\nNote:\ncommit 094ee6017ea0 (\"bonding: check xdp prog when set bond mode\")\nlater added a similar guard to bond_option_mode_set(), but\nbond_option_xmit_hash_policy_set() remained unprotected."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:05.943Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c262bd0e39320a6d6c8277cb8349ce21c01b8c1"
},
{
"url": "https://git.kernel.org/stable/c/d36ad7e126c6a0c5f699583309ccc37e3a3263ea"
},
{
"url": "https://git.kernel.org/stable/c/0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e"
},
{
"url": "https://git.kernel.org/stable/c/e85fa809e507b9d8eff4840888b8c727e4e8448c"
},
{
"url": "https://git.kernel.org/stable/c/479d589b40b836442bbdadc3fdb37f001bb67f26"
}
],
"title": "bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23310",
"datePublished": "2026-03-25T10:27:05.943Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:05.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23369 (GCVE-0-2026-23369)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1.
Under rare circumstances, multiple udev threads can collect i801 device
info on boot and walk i801_acpi_io_handler somewhat concurrently. The
first will note the area is reserved by acpi to prevent further touches.
This ultimately causes the area to be deregistered. The second will
enter i801_acpi_io_handler after the area is unregistered but before a
check can be made that the area is unregistered. i2c_lock_bus relies on
the now unregistered area containing lock_ops to lock the bus. The end
result is a kernel panic on boot with the following backtrace;
[ 14.971872] ioatdma 0000:09:00.2: enabling device (0100 -> 0102)
[ 14.971873] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 14.971880] #PF: supervisor read access in kernel mode
[ 14.971884] #PF: error_code(0x0000) - not-present page
[ 14.971887] PGD 0 P4D 0
[ 14.971894] Oops: 0000 [#1] PREEMPT SMP PTI
[ 14.971900] CPU: 5 PID: 956 Comm: systemd-udevd Not tainted 5.14.0-611.5.1.el9_7.x86_64 #1
[ 14.971905] Hardware name: XXXXXXXXXXXXXXXXXXXXXXX BIOS 1.20.10.SV91 01/30/2023
[ 14.971908] RIP: 0010:i801_acpi_io_handler+0x2d/0xb0 [i2c_i801]
[ 14.971929] Code: 00 00 49 8b 40 20 41 57 41 56 4d 8b b8 30 04 00 00 49 89 ce 41 55 41 89 d5 41 54 49 89 f4 be 02 00 00 00 55 4c 89 c5 53 89 fb <48> 8b 00 4c 89 c7 e8 18 61 54 e9 80 bd 80 04 00 00 00 75 09 4c 3b
[ 14.971933] RSP: 0018:ffffbaa841483838 EFLAGS: 00010282
[ 14.971938] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9685e01ba568
[ 14.971941] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000000
[ 14.971944] RBP: ffff9685ca22f028 R08: ffff9685ca22f028 R09: ffff9685ca22f028
[ 14.971948] R10: 000000000000000b R11: 0000000000000580 R12: 0000000000000580
[ 14.971951] R13: 0000000000000008 R14: ffff9685e01ba568 R15: ffff9685c222f000
[ 14.971954] FS: 00007f8287c0ab40(0000) GS:ffff96a47f940000(0000) knlGS:0000000000000000
[ 14.971959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.971963] CR2: 0000000000000000 CR3: 0000000168090001 CR4: 00000000003706f0
[ 14.971966] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 14.971968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 14.971972] Call Trace:
[ 14.971977] <TASK>
[ 14.971981] ? show_trace_log_lvl+0x1c4/0x2df
[ 14.971994] ? show_trace_log_lvl+0x1c4/0x2df
[ 14.972003] ? acpi_ev_address_space_dispatch+0x16e/0x3c0
[ 14.972014] ? __die_body.cold+0x8/0xd
[ 14.972021] ? page_fault_oops+0x132/0x170
[ 14.972028] ? exc_page_fault+0x61/0x150
[ 14.972036] ? asm_exc_page_fault+0x22/0x30
[ 14.972045] ? i801_acpi_io_handler+0x2d/0xb0 [i2c_i801]
[ 14.972061] acpi_ev_address_space_dispatch+0x16e/0x3c0
[ 14.972069] ? __pfx_i801_acpi_io_handler+0x10/0x10 [i2c_i801]
[ 14.972085] acpi_ex_access_region+0x5b/0xd0
[ 14.972093] acpi_ex_field_datum_io+0x73/0x2e0
[ 14.972100] acpi_ex_read_data_from_field+0x8e/0x230
[ 14.972106] acpi_ex_resolve_node_to_value+0x23d/0x310
[ 14.972114] acpi_ds_evaluate_name_path+0xad/0x110
[ 14.972121] acpi_ds_exec_end_op+0x321/0x510
[ 14.972127] acpi_ps_parse_loop+0xf7/0x680
[ 14.972136] acpi_ps_parse_aml+0x17a/0x3d0
[ 14.972143] acpi_ps_execute_method+0x137/0x270
[ 14.972150] acpi_ns_evaluate+0x1f4/0x2e0
[ 14.972158] acpi_evaluate_object+0x134/0x2f0
[ 14.972164] acpi_evaluate_integer+0x50/0xe0
[ 14.972173] ? vsnprintf+0x24b/0x570
[ 14.972181] acpi_ac_get_state.part.0+0x23/0x70
[ 14.972189] get_ac_property+0x4e/0x60
[ 14.972195] power_supply_show_property+0x90/0x1f0
[ 14.972205] add_prop_uevent+0x29/0x90
[ 14.972213] power_supply_uevent+0x109/0x1d0
[ 14.972222] dev_uevent+0x10e/0x2f0
[ 14.972228] uevent_show+0x8e/0x100
[ 14.972236] dev_attr_show+0x19
---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
f707d6b9e7c18f669adfdb443906d46cfbaaa0c1 , < 9507f9953a2a5647eb42668d0c243fdbd7e72954
(git)
Affected: f707d6b9e7c18f669adfdb443906d46cfbaaa0c1 , < 1c72e7b0b442ce21a1348d9b8237cfddb67048eb (git) Affected: f707d6b9e7c18f669adfdb443906d46cfbaaa0c1 , < c726273044a5a8308a889d19d6884135c0f3321d (git) Affected: f707d6b9e7c18f669adfdb443906d46cfbaaa0c1 , < cfc69c2e6c699c96949f7b0455195b0bfb7dc715 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-i801.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9507f9953a2a5647eb42668d0c243fdbd7e72954",
"status": "affected",
"version": "f707d6b9e7c18f669adfdb443906d46cfbaaa0c1",
"versionType": "git"
},
{
"lessThan": "1c72e7b0b442ce21a1348d9b8237cfddb67048eb",
"status": "affected",
"version": "f707d6b9e7c18f669adfdb443906d46cfbaaa0c1",
"versionType": "git"
},
{
"lessThan": "c726273044a5a8308a889d19d6884135c0f3321d",
"status": "affected",
"version": "f707d6b9e7c18f669adfdb443906d46cfbaaa0c1",
"versionType": "git"
},
{
"lessThan": "cfc69c2e6c699c96949f7b0455195b0bfb7dc715",
"status": "affected",
"version": "f707d6b9e7c18f669adfdb443906d46cfbaaa0c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-i801.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"\n\nThis reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1.\n\nUnder rare circumstances, multiple udev threads can collect i801 device\ninfo on boot and walk i801_acpi_io_handler somewhat concurrently. The\nfirst will note the area is reserved by acpi to prevent further touches.\nThis ultimately causes the area to be deregistered. The second will\nenter i801_acpi_io_handler after the area is unregistered but before a\ncheck can be made that the area is unregistered. i2c_lock_bus relies on\nthe now unregistered area containing lock_ops to lock the bus. The end\nresult is a kernel panic on boot with the following backtrace;\n\n[ 14.971872] ioatdma 0000:09:00.2: enabling device (0100 -\u003e 0102)\n[ 14.971873] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 14.971880] #PF: supervisor read access in kernel mode\n[ 14.971884] #PF: error_code(0x0000) - not-present page\n[ 14.971887] PGD 0 P4D 0\n[ 14.971894] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 14.971900] CPU: 5 PID: 956 Comm: systemd-udevd Not tainted 5.14.0-611.5.1.el9_7.x86_64 #1\n[ 14.971905] Hardware name: XXXXXXXXXXXXXXXXXXXXXXX BIOS 1.20.10.SV91 01/30/2023\n[ 14.971908] RIP: 0010:i801_acpi_io_handler+0x2d/0xb0 [i2c_i801]\n[ 14.971929] Code: 00 00 49 8b 40 20 41 57 41 56 4d 8b b8 30 04 00 00 49 89 ce 41 55 41 89 d5 41 54 49 89 f4 be 02 00 00 00 55 4c 89 c5 53 89 fb \u003c48\u003e 8b 00 4c 89 c7 e8 18 61 54 e9 80 bd 80 04 00 00 00 75 09 4c 3b\n[ 14.971933] RSP: 0018:ffffbaa841483838 EFLAGS: 00010282\n[ 14.971938] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9685e01ba568\n[ 14.971941] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000000\n[ 14.971944] RBP: ffff9685ca22f028 R08: ffff9685ca22f028 R09: ffff9685ca22f028\n[ 14.971948] R10: 000000000000000b R11: 0000000000000580 R12: 0000000000000580\n[ 14.971951] R13: 0000000000000008 R14: ffff9685e01ba568 R15: ffff9685c222f000\n[ 14.971954] FS: 00007f8287c0ab40(0000) GS:ffff96a47f940000(0000) knlGS:0000000000000000\n[ 14.971959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 14.971963] CR2: 0000000000000000 CR3: 0000000168090001 CR4: 00000000003706f0\n[ 14.971966] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 14.971968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 14.971972] Call Trace:\n[ 14.971977] \u003cTASK\u003e\n[ 14.971981] ? show_trace_log_lvl+0x1c4/0x2df\n[ 14.971994] ? show_trace_log_lvl+0x1c4/0x2df\n[ 14.972003] ? acpi_ev_address_space_dispatch+0x16e/0x3c0\n[ 14.972014] ? __die_body.cold+0x8/0xd\n[ 14.972021] ? page_fault_oops+0x132/0x170\n[ 14.972028] ? exc_page_fault+0x61/0x150\n[ 14.972036] ? asm_exc_page_fault+0x22/0x30\n[ 14.972045] ? i801_acpi_io_handler+0x2d/0xb0 [i2c_i801]\n[ 14.972061] acpi_ev_address_space_dispatch+0x16e/0x3c0\n[ 14.972069] ? __pfx_i801_acpi_io_handler+0x10/0x10 [i2c_i801]\n[ 14.972085] acpi_ex_access_region+0x5b/0xd0\n[ 14.972093] acpi_ex_field_datum_io+0x73/0x2e0\n[ 14.972100] acpi_ex_read_data_from_field+0x8e/0x230\n[ 14.972106] acpi_ex_resolve_node_to_value+0x23d/0x310\n[ 14.972114] acpi_ds_evaluate_name_path+0xad/0x110\n[ 14.972121] acpi_ds_exec_end_op+0x321/0x510\n[ 14.972127] acpi_ps_parse_loop+0xf7/0x680\n[ 14.972136] acpi_ps_parse_aml+0x17a/0x3d0\n[ 14.972143] acpi_ps_execute_method+0x137/0x270\n[ 14.972150] acpi_ns_evaluate+0x1f4/0x2e0\n[ 14.972158] acpi_evaluate_object+0x134/0x2f0\n[ 14.972164] acpi_evaluate_integer+0x50/0xe0\n[ 14.972173] ? vsnprintf+0x24b/0x570\n[ 14.972181] acpi_ac_get_state.part.0+0x23/0x70\n[ 14.972189] get_ac_property+0x4e/0x60\n[ 14.972195] power_supply_show_property+0x90/0x1f0\n[ 14.972205] add_prop_uevent+0x29/0x90\n[ 14.972213] power_supply_uevent+0x109/0x1d0\n[ 14.972222] dev_uevent+0x10e/0x2f0\n[ 14.972228] uevent_show+0x8e/0x100\n[ 14.972236] dev_attr_show+0x19\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:50.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9507f9953a2a5647eb42668d0c243fdbd7e72954"
},
{
"url": "https://git.kernel.org/stable/c/1c72e7b0b442ce21a1348d9b8237cfddb67048eb"
},
{
"url": "https://git.kernel.org/stable/c/c726273044a5a8308a889d19d6884135c0f3321d"
},
{
"url": "https://git.kernel.org/stable/c/cfc69c2e6c699c96949f7b0455195b0bfb7dc715"
}
],
"title": "i2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23369",
"datePublished": "2026-03-25T10:27:50.705Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:50.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23386 (GCVE-0-2026-23386)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:28 – Updated: 2026-03-25 10:28
VLAI?
EPSS
Title
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
Summary
In the Linux kernel, the following vulnerability has been resolved:
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA
buffer cleanup path. It iterates num_bufs times and attempts to unmap
entries in the dma array.
This leads to two issues:
1. The dma array shares storage with tx_qpl_buf_ids (union).
Interpreting buffer IDs as DMA addresses results in attempting to
unmap incorrect memory locations.
2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed
the size of the dma array, causing out-of-bounds access warnings
(trace below is how we noticed this issue).
UBSAN: array-index-out-of-bounds in
drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of
range for type 'dma_addr_t[18]' (aka 'unsigned long long[18]')
Workqueue: gve gve_service_task [gve]
Call Trace:
<TASK>
dump_stack_lvl+0x33/0xa0
__ubsan_handle_out_of_bounds+0xdc/0x110
gve_tx_stop_ring_dqo+0x182/0x200 [gve]
gve_close+0x1be/0x450 [gve]
gve_reset+0x99/0x120 [gve]
gve_service_task+0x61/0x100 [gve]
process_scheduled_works+0x1e9/0x380
Fix this by properly checking for QPL mode and delegating to
gve_free_tx_qpl_bufs() to reclaim the buffers.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
a6fb8d5a8b6925f1e635818d3dd2d89531d4a058 , < 71511dae56a75ce161aa746741e5c498feaea393
(git)
Affected: a6fb8d5a8b6925f1e635818d3dd2d89531d4a058 , < c171f90f58974c784db25e0606051541cb71b7f0 (git) Affected: a6fb8d5a8b6925f1e635818d3dd2d89531d4a058 , < 07e0c80e17ef781799e7cd5c41a7bf44f1bf6a5f (git) Affected: a6fb8d5a8b6925f1e635818d3dd2d89531d4a058 , < 3744ebd8ffaa542ae8110fb449adcac0202f4cc8 (git) Affected: a6fb8d5a8b6925f1e635818d3dd2d89531d4a058 , < fb868db5f4bccd7a78219313ab2917429f715cea (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/google/gve/gve_tx_dqo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "71511dae56a75ce161aa746741e5c498feaea393",
"status": "affected",
"version": "a6fb8d5a8b6925f1e635818d3dd2d89531d4a058",
"versionType": "git"
},
{
"lessThan": "c171f90f58974c784db25e0606051541cb71b7f0",
"status": "affected",
"version": "a6fb8d5a8b6925f1e635818d3dd2d89531d4a058",
"versionType": "git"
},
{
"lessThan": "07e0c80e17ef781799e7cd5c41a7bf44f1bf6a5f",
"status": "affected",
"version": "a6fb8d5a8b6925f1e635818d3dd2d89531d4a058",
"versionType": "git"
},
{
"lessThan": "3744ebd8ffaa542ae8110fb449adcac0202f4cc8",
"status": "affected",
"version": "a6fb8d5a8b6925f1e635818d3dd2d89531d4a058",
"versionType": "git"
},
{
"lessThan": "fb868db5f4bccd7a78219313ab2917429f715cea",
"status": "affected",
"version": "a6fb8d5a8b6925f1e635818d3dd2d89531d4a058",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/google/gve/gve_tx_dqo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL\n\nIn DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA\nbuffer cleanup path. It iterates num_bufs times and attempts to unmap\nentries in the dma array.\n\nThis leads to two issues:\n1. The dma array shares storage with tx_qpl_buf_ids (union).\n Interpreting buffer IDs as DMA addresses results in attempting to\n unmap incorrect memory locations.\n2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed\n the size of the dma array, causing out-of-bounds access warnings\n(trace below is how we noticed this issue).\n\nUBSAN: array-index-out-of-bounds in\ndrivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of\nrange for type \u0027dma_addr_t[18]\u0027 (aka \u0027unsigned long long[18]\u0027)\nWorkqueue: gve gve_service_task [gve]\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x33/0xa0\n__ubsan_handle_out_of_bounds+0xdc/0x110\ngve_tx_stop_ring_dqo+0x182/0x200 [gve]\ngve_close+0x1be/0x450 [gve]\ngve_reset+0x99/0x120 [gve]\ngve_service_task+0x61/0x100 [gve]\nprocess_scheduled_works+0x1e9/0x380\n\nFix this by properly checking for QPL mode and delegating to\ngve_free_tx_qpl_bufs() to reclaim the buffers."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:28:04.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/71511dae56a75ce161aa746741e5c498feaea393"
},
{
"url": "https://git.kernel.org/stable/c/c171f90f58974c784db25e0606051541cb71b7f0"
},
{
"url": "https://git.kernel.org/stable/c/07e0c80e17ef781799e7cd5c41a7bf44f1bf6a5f"
},
{
"url": "https://git.kernel.org/stable/c/3744ebd8ffaa542ae8110fb449adcac0202f4cc8"
},
{
"url": "https://git.kernel.org/stable/c/fb868db5f4bccd7a78219313ab2917429f715cea"
}
],
"title": "gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23386",
"datePublished": "2026-03-25T10:28:04.118Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-03-25T10:28:04.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23316 (GCVE-0-2026-23316)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
net: ipv4: fix ARM64 alignment fault in multipath hash seed
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: fix ARM64 alignment fault in multipath hash seed
`struct sysctl_fib_multipath_hash_seed` contains two u32 fields
(user_seed and mp_seed), making it an 8-byte structure with a 4-byte
alignment requirement.
In `fib_multipath_hash_from_keys()`, the code evaluates the entire
struct atomically via `READ_ONCE()`:
mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed;
While this silently works on GCC by falling back to unaligned regular
loads which the ARM64 kernel tolerates, it causes a fatal kernel panic
when compiled with Clang and LTO enabled.
Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire
when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire
instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs
under Clang LTO. Since the macro evaluates the full 8-byte struct,
Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly
requires `ldar` to be naturally aligned, thus executing it on a 4-byte
aligned address triggers a strict Alignment Fault (FSC = 0x21).
Fix the read side by moving the `READ_ONCE()` directly to the `u32`
member, which emits a safe 32-bit `ldar Wn`.
Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire
struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis
shows that Clang splits this 8-byte write into two separate 32-bit
`str` instructions. While this avoids an alignment fault, it destroys
atomicity and exposes a tear-write vulnerability. Fix this by
explicitly splitting the write into two 32-bit `WRITE_ONCE()`
operations.
Finally, add the missing `READ_ONCE()` when reading `user_seed` in
`proc_fib_multipath_hash_seed()` to ensure proper pairing and
concurrency safety.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 , < 4bdc94d45d5459f0149085dfc1efe733c8e14f11
(git)
Affected: 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 , < 7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199 (git) Affected: 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 , < 607e923a3c1b2120de430b3dcde25ed8ad213c0a (git) Affected: 4ee2a8cace3fb9a34aea6a56426f89d26dd514f3 , < 4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_fib.h",
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4bdc94d45d5459f0149085dfc1efe733c8e14f11",
"status": "affected",
"version": "4ee2a8cace3fb9a34aea6a56426f89d26dd514f3",
"versionType": "git"
},
{
"lessThan": "7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199",
"status": "affected",
"version": "4ee2a8cace3fb9a34aea6a56426f89d26dd514f3",
"versionType": "git"
},
{
"lessThan": "607e923a3c1b2120de430b3dcde25ed8ad213c0a",
"status": "affected",
"version": "4ee2a8cace3fb9a34aea6a56426f89d26dd514f3",
"versionType": "git"
},
{
"lessThan": "4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f",
"status": "affected",
"version": "4ee2a8cace3fb9a34aea6a56426f89d26dd514f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_fib.h",
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix ARM64 alignment fault in multipath hash seed\n\n`struct sysctl_fib_multipath_hash_seed` contains two u32 fields\n(user_seed and mp_seed), making it an 8-byte structure with a 4-byte\nalignment requirement.\n\nIn `fib_multipath_hash_from_keys()`, the code evaluates the entire\nstruct atomically via `READ_ONCE()`:\n\n mp_seed = READ_ONCE(net-\u003eipv4.sysctl_fib_multipath_hash_seed).mp_seed;\n\nWhile this silently works on GCC by falling back to unaligned regular\nloads which the ARM64 kernel tolerates, it causes a fatal kernel panic\nwhen compiled with Clang and LTO enabled.\n\nCommit e35123d83ee3 (\"arm64: lto: Strengthen READ_ONCE() to acquire\nwhen CONFIG_LTO=y\") strengthens `READ_ONCE()` to use Load-Acquire\ninstructions (`ldar` / `ldapr`) to prevent compiler reordering bugs\nunder Clang LTO. Since the macro evaluates the full 8-byte struct,\nClang emits a 64-bit `ldar` instruction. ARM64 architecture strictly\nrequires `ldar` to be naturally aligned, thus executing it on a 4-byte\naligned address triggers a strict Alignment Fault (FSC = 0x21).\n\nFix the read side by moving the `READ_ONCE()` directly to the `u32`\nmember, which emits a safe 32-bit `ldar Wn`.\n\nFurthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire\nstruct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis\nshows that Clang splits this 8-byte write into two separate 32-bit\n`str` instructions. While this avoids an alignment fault, it destroys\natomicity and exposes a tear-write vulnerability. Fix this by\nexplicitly splitting the write into two 32-bit `WRITE_ONCE()`\noperations.\n\nFinally, add the missing `READ_ONCE()` when reading `user_seed` in\n`proc_fib_multipath_hash_seed()` to ensure proper pairing and\nconcurrency safety."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:11.028Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4bdc94d45d5459f0149085dfc1efe733c8e14f11"
},
{
"url": "https://git.kernel.org/stable/c/7e4ad34a8889a6a9e0f6cc7c55d02161fe31a199"
},
{
"url": "https://git.kernel.org/stable/c/607e923a3c1b2120de430b3dcde25ed8ad213c0a"
},
{
"url": "https://git.kernel.org/stable/c/4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f"
}
],
"title": "net: ipv4: fix ARM64 alignment fault in multipath hash seed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23316",
"datePublished": "2026-03-25T10:27:11.028Z",
"dateReserved": "2026-01-13T15:37:45.995Z",
"dateUpdated": "2026-03-25T10:27:11.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23334 (GCVE-0-2026-23334)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
can: usb: f81604: handle short interrupt urb messages properly
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: usb: f81604: handle short interrupt urb messages properly
If an interrupt urb is received that is not the correct length, properly
detect it and don't attempt to treat the data as valid.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
88da17436973e463bed59bea79771fb03a21555e , < 9b740ff5bc649575a5e14ca8ee54e3dd5010aaf0
(git)
Affected: 88da17436973e463bed59bea79771fb03a21555e , < c5d69da6c919648838734097861e979677eedcde (git) Affected: 88da17436973e463bed59bea79771fb03a21555e , < 36ead57443146e6b730ce1f48ca3e9b17e19a3d2 (git) Affected: 88da17436973e463bed59bea79771fb03a21555e , < 66615e6293388f75a56226d1216fd9cfb3d95e05 (git) Affected: 88da17436973e463bed59bea79771fb03a21555e , < 7299b1b39a255f6092ce4ec0b65f66e9d6a357af (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/f81604.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9b740ff5bc649575a5e14ca8ee54e3dd5010aaf0",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "c5d69da6c919648838734097861e979677eedcde",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "36ead57443146e6b730ce1f48ca3e9b17e19a3d2",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "66615e6293388f75a56226d1216fd9cfb3d95e05",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
},
{
"lessThan": "7299b1b39a255f6092ce4ec0b65f66e9d6a357af",
"status": "affected",
"version": "88da17436973e463bed59bea79771fb03a21555e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/f81604.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: usb: f81604: handle short interrupt urb messages properly\n\nIf an interrupt urb is received that is not the correct length, properly\ndetect it and don\u0027t attempt to treat the data as valid."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:24.664Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9b740ff5bc649575a5e14ca8ee54e3dd5010aaf0"
},
{
"url": "https://git.kernel.org/stable/c/c5d69da6c919648838734097861e979677eedcde"
},
{
"url": "https://git.kernel.org/stable/c/36ead57443146e6b730ce1f48ca3e9b17e19a3d2"
},
{
"url": "https://git.kernel.org/stable/c/66615e6293388f75a56226d1216fd9cfb3d95e05"
},
{
"url": "https://git.kernel.org/stable/c/7299b1b39a255f6092ce4ec0b65f66e9d6a357af"
}
],
"title": "can: usb: f81604: handle short interrupt urb messages properly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23334",
"datePublished": "2026-03-25T10:27:24.664Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:24.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23375 (GCVE-0-2026-23375)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
mm: thp: deny THP for files on anonymous inodes
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: thp: deny THP for files on anonymous inodes
file_thp_enabled() incorrectly allows THP for files on anonymous inodes
(e.g. guest_memfd and secretmem). These files are created via
alloc_file_pseudo(), which does not call get_write_access() and leaves
inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being
true, they appear as read-only regular files when
CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP
collapse.
Anonymous inodes can never pass the inode_is_open_for_write() check
since their i_writecount is never incremented through the normal VFS
open path. The right thing to do is to exclude them from THP eligibility
altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real
filesystem files (e.g. shared libraries), not for pseudo-filesystem
inodes.
For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create
large folios in the page cache via the collapse path, but the
guest_memfd fault handler does not support large folios. This triggers
WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping().
For secretmem, collapse_file() tries to copy page contents through the
direct map, but secretmem pages are removed from the direct map. This
can result in a kernel crash:
BUG: unable to handle page fault for address: ffff88810284d000
RIP: 0010:memcpy_orig+0x16/0x130
Call Trace:
collapse_file
hpage_collapse_scan_file
madvise_collapse
Secretmem is not affected by the crash on upstream as the memory failure
recovery handles the failed copy gracefully, but it still triggers
confusing false memory failure reports:
Memory failure: 0x106d96f: recovery action for clean unevictable
LRU page: Recovered
Check IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all
anonymous inode files.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7fbb5e188248c50f737720825da1864ce42536d1 , < 08de46a75f91a6661bc1ce0a93614f4bc313c581
(git)
Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < 0524ee56af2c9bfbad152a810f1ca95de8ca00d7 (git) Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < f6fa05f0dddd387417d0c28281ddb951582514d6 (git) Affected: 7fbb5e188248c50f737720825da1864ce42536d1 , < dd085fe9a8ebfc5d10314c60452db38d2b75e609 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08de46a75f91a6661bc1ce0a93614f4bc313c581",
"status": "affected",
"version": "7fbb5e188248c50f737720825da1864ce42536d1",
"versionType": "git"
},
{
"lessThan": "0524ee56af2c9bfbad152a810f1ca95de8ca00d7",
"status": "affected",
"version": "7fbb5e188248c50f737720825da1864ce42536d1",
"versionType": "git"
},
{
"lessThan": "f6fa05f0dddd387417d0c28281ddb951582514d6",
"status": "affected",
"version": "7fbb5e188248c50f737720825da1864ce42536d1",
"versionType": "git"
},
{
"lessThan": "dd085fe9a8ebfc5d10314c60452db38d2b75e609",
"status": "affected",
"version": "7fbb5e188248c50f737720825da1864ce42536d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: thp: deny THP for files on anonymous inodes\n\nfile_thp_enabled() incorrectly allows THP for files on anonymous inodes\n(e.g. guest_memfd and secretmem). These files are created via\nalloc_file_pseudo(), which does not call get_write_access() and leaves\ninode-\u003ei_writecount at 0. Combined with S_ISREG(inode-\u003ei_mode) being\ntrue, they appear as read-only regular files when\nCONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP\ncollapse.\n\nAnonymous inodes can never pass the inode_is_open_for_write() check\nsince their i_writecount is never incremented through the normal VFS\nopen path. The right thing to do is to exclude them from THP eligibility\naltogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real\nfilesystem files (e.g. shared libraries), not for pseudo-filesystem\ninodes.\n\nFor guest_memfd, this allows khugepaged and MADV_COLLAPSE to create\nlarge folios in the page cache via the collapse path, but the\nguest_memfd fault handler does not support large folios. This triggers\nWARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping().\n\nFor secretmem, collapse_file() tries to copy page contents through the\ndirect map, but secretmem pages are removed from the direct map. This\ncan result in a kernel crash:\n\n BUG: unable to handle page fault for address: ffff88810284d000\n RIP: 0010:memcpy_orig+0x16/0x130\n Call Trace:\n collapse_file\n hpage_collapse_scan_file\n madvise_collapse\n\nSecretmem is not affected by the crash on upstream as the memory failure\nrecovery handles the failed copy gracefully, but it still triggers\nconfusing false memory failure reports:\n\n Memory failure: 0x106d96f: recovery action for clean unevictable\n LRU page: Recovered\n\nCheck IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all\nanonymous inode files."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:55.754Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08de46a75f91a6661bc1ce0a93614f4bc313c581"
},
{
"url": "https://git.kernel.org/stable/c/0524ee56af2c9bfbad152a810f1ca95de8ca00d7"
},
{
"url": "https://git.kernel.org/stable/c/f6fa05f0dddd387417d0c28281ddb951582514d6"
},
{
"url": "https://git.kernel.org/stable/c/dd085fe9a8ebfc5d10314c60452db38d2b75e609"
}
],
"title": "mm: thp: deny THP for files on anonymous inodes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23375",
"datePublished": "2026-03-25T10:27:55.754Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-03-25T10:27:55.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23359 (GCVE-0-2026-23359)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
bpf: Fix stack-out-of-bounds write in devmap
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stack-out-of-bounds write in devmap
get_upper_ifindexes() iterates over all upper devices and writes their
indices into an array without checking bounds.
Also the callers assume that the max number of upper devices is
MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,
but that assumption is not correct and the number of upper devices could
be larger than MAX_NEST_DEV (e.g., many macvlans), causing a
stack-out-of-bounds write.
Add a max parameter to get_upper_ifindexes() to avoid the issue.
When there are too many upper devices, return -EOVERFLOW and abort the
redirect.
To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with
an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.
Then send a packet to the device to trigger the XDP redirect path.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
aeea1b86f9363f3feabb496534d886f082a89f21 , < 5000e40acc8d0c36ab709662e32120986ac22e7e
(git)
Affected: aeea1b86f9363f3feabb496534d886f082a89f21 , < 8a95fb9df1105b1618872c2846a6c01e3ba20b45 (git) Affected: aeea1b86f9363f3feabb496534d886f082a89f21 , < d2c31d8e03d05edc16656e5ffe187f0d1da763d7 (git) Affected: aeea1b86f9363f3feabb496534d886f082a89f21 , < 75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2 (git) Affected: aeea1b86f9363f3feabb496534d886f082a89f21 , < ca831567908fd3f73cf97d8a6c09a5054697a182 (git) Affected: aeea1b86f9363f3feabb496534d886f082a89f21 , < b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5000e40acc8d0c36ab709662e32120986ac22e7e",
"status": "affected",
"version": "aeea1b86f9363f3feabb496534d886f082a89f21",
"versionType": "git"
},
{
"lessThan": "8a95fb9df1105b1618872c2846a6c01e3ba20b45",
"status": "affected",
"version": "aeea1b86f9363f3feabb496534d886f082a89f21",
"versionType": "git"
},
{
"lessThan": "d2c31d8e03d05edc16656e5ffe187f0d1da763d7",
"status": "affected",
"version": "aeea1b86f9363f3feabb496534d886f082a89f21",
"versionType": "git"
},
{
"lessThan": "75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2",
"status": "affected",
"version": "aeea1b86f9363f3feabb496534d886f082a89f21",
"versionType": "git"
},
{
"lessThan": "ca831567908fd3f73cf97d8a6c09a5054697a182",
"status": "affected",
"version": "aeea1b86f9363f3feabb496534d886f082a89f21",
"versionType": "git"
},
{
"lessThan": "b7bf516c3ecd9a2aae2dc2635178ab87b734fef1",
"status": "affected",
"version": "aeea1b86f9363f3feabb496534d886f082a89f21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:43.070Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e"
},
{
"url": "https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45"
},
{
"url": "https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7"
},
{
"url": "https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2"
},
{
"url": "https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182"
},
{
"url": "https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1"
}
],
"title": "bpf: Fix stack-out-of-bounds write in devmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23359",
"datePublished": "2026-03-25T10:27:43.070Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:43.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23314 (GCVE-0-2026-23314)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()
In bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns
without calling of_node_put(child), causing the device node reference
leak.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
981dd162b63578aee34b5c68795e246734b76d70 , < 93b64bef8cd4074806d981ed1b4c38c3ae0542e3
(git)
Affected: 981dd162b63578aee34b5c68795e246734b76d70 , < aba54a5a113667df9d339f4192650f6bc27e9d1f (git) Affected: 981dd162b63578aee34b5c68795e246734b76d70 , < 4baaddaa44af01cd4ce239493060738fd0881835 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/regulator/bq257xx-regulator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93b64bef8cd4074806d981ed1b4c38c3ae0542e3",
"status": "affected",
"version": "981dd162b63578aee34b5c68795e246734b76d70",
"versionType": "git"
},
{
"lessThan": "aba54a5a113667df9d339f4192650f6bc27e9d1f",
"status": "affected",
"version": "981dd162b63578aee34b5c68795e246734b76d70",
"versionType": "git"
},
{
"lessThan": "4baaddaa44af01cd4ce239493060738fd0881835",
"status": "affected",
"version": "981dd162b63578aee34b5c68795e246734b76d70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/regulator/bq257xx-regulator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()\n\nIn bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns\nwithout calling of_node_put(child), causing the device node reference\nleak."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:09.383Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93b64bef8cd4074806d981ed1b4c38c3ae0542e3"
},
{
"url": "https://git.kernel.org/stable/c/aba54a5a113667df9d339f4192650f6bc27e9d1f"
},
{
"url": "https://git.kernel.org/stable/c/4baaddaa44af01cd4ce239493060738fd0881835"
}
],
"title": "regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23314",
"datePublished": "2026-03-25T10:27:09.383Z",
"dateReserved": "2026-01-13T15:37:45.994Z",
"dateUpdated": "2026-03-25T10:27:09.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23352 (GCVE-0-2026-23352)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
x86/efi: defer freeing of boot services memory
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/efi: defer freeing of boot services memory
efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE
and EFI_BOOT_SERVICES_DATA using memblock_free_late().
There are two issue with that: memblock_free_late() should be used for
memory allocated with memblock_alloc() while the memory reserved with
memblock_reserve() should be freed with free_reserved_area().
More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
efi_free_boot_services() is called before deferred initialization of the
memory map is complete.
Benjamin Herrenschmidt reports that this causes a leak of ~140MB of
RAM on EC2 t3a.nano instances which only have 512MB or RAM.
If the freed memory resides in the areas that memory map for them is
still uninitialized, they won't be actually freed because
memblock_free_late() calls memblock_free_pages() and the latter skips
uninitialized pages.
Using free_reserved_area() at this point is also problematic because
__free_page() accesses the buddy of the freed page and that again might
end up in uninitialized part of the memory map.
Delaying the entire efi_free_boot_services() could be problematic
because in addition to freeing boot services memory it updates
efi.memmap without any synchronization and that's undesirable late in
boot when there is concurrency.
More robust approach is to only defer freeing of the EFI boot services
memory.
Split efi_free_boot_services() in two. First efi_unmap_boot_services()
collects ranges that should be freed into an array then
efi_free_boot_services() later frees them after deferred init is complete.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
0aed459e8487eb6ebdb4efe8cefe1eafbc704b30 , < 4a2cb90c538f06c873a187aa743575d48685d7a6
(git)
Affected: 916f676f8dc016103f983c7ec54c18ecdbb6e349 , < 227688312fece0026fc67a00ba9a0b3611ebe95d (git) Affected: 916f676f8dc016103f983c7ec54c18ecdbb6e349 , < 6a25e25279282c5c8ade554c04c6ab9dc7902c64 (git) Affected: 916f676f8dc016103f983c7ec54c18ecdbb6e349 , < 399da820ecfe6f4f10c143e5c453d3559a04db9c (git) Affected: 916f676f8dc016103f983c7ec54c18ecdbb6e349 , < f9e9cc320854a76a39e7bc92d144554f3a727fad (git) Affected: 916f676f8dc016103f983c7ec54c18ecdbb6e349 , < 7dcf59422a3b0d20ddda844f856b4a1e0608a326 (git) Affected: 916f676f8dc016103f983c7ec54c18ecdbb6e349 , < a4b0bf6a40f3c107c67a24fbc614510ef5719980 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/efi.h",
"arch/x86/platform/efi/efi.c",
"arch/x86/platform/efi/quirks.c",
"drivers/firmware/efi/mokvar-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a2cb90c538f06c873a187aa743575d48685d7a6",
"status": "affected",
"version": "0aed459e8487eb6ebdb4efe8cefe1eafbc704b30",
"versionType": "git"
},
{
"lessThan": "227688312fece0026fc67a00ba9a0b3611ebe95d",
"status": "affected",
"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349",
"versionType": "git"
},
{
"lessThan": "6a25e25279282c5c8ade554c04c6ab9dc7902c64",
"status": "affected",
"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349",
"versionType": "git"
},
{
"lessThan": "399da820ecfe6f4f10c143e5c453d3559a04db9c",
"status": "affected",
"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349",
"versionType": "git"
},
{
"lessThan": "f9e9cc320854a76a39e7bc92d144554f3a727fad",
"status": "affected",
"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349",
"versionType": "git"
},
{
"lessThan": "7dcf59422a3b0d20ddda844f856b4a1e0608a326",
"status": "affected",
"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349",
"versionType": "git"
},
{
"lessThan": "a4b0bf6a40f3c107c67a24fbc614510ef5719980",
"status": "affected",
"version": "916f676f8dc016103f983c7ec54c18ecdbb6e349",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/efi.h",
"arch/x86/platform/efi/efi.c",
"arch/x86/platform/efi/quirks.c",
"drivers/firmware/efi/mokvar-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.6.*",
"status": "unaffected",
"version": "2.6.39.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.39.2",
"versionStartIncluding": "2.6.39.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won\u0027t be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that\u0027s undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:37.500Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a2cb90c538f06c873a187aa743575d48685d7a6"
},
{
"url": "https://git.kernel.org/stable/c/227688312fece0026fc67a00ba9a0b3611ebe95d"
},
{
"url": "https://git.kernel.org/stable/c/6a25e25279282c5c8ade554c04c6ab9dc7902c64"
},
{
"url": "https://git.kernel.org/stable/c/399da820ecfe6f4f10c143e5c453d3559a04db9c"
},
{
"url": "https://git.kernel.org/stable/c/f9e9cc320854a76a39e7bc92d144554f3a727fad"
},
{
"url": "https://git.kernel.org/stable/c/7dcf59422a3b0d20ddda844f856b4a1e0608a326"
},
{
"url": "https://git.kernel.org/stable/c/a4b0bf6a40f3c107c67a24fbc614510ef5719980"
}
],
"title": "x86/efi: defer freeing of boot services memory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23352",
"datePublished": "2026-03-25T10:27:37.500Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:37.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23284 (GCVE-0-2026-23284)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 10:26
VLAI?
EPSS
Title
net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
Reset eBPF program pointer to old_prog and do not decrease its ref-count
if mtk_open routine in mtk_xdp_setup() fails.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
7c26c20da5d420cde55618263be4aa2f6de53056 , < 8c2d76a9658a4dbfcf02f2693a97e2d5ff42197a
(git)
Affected: 7c26c20da5d420cde55618263be4aa2f6de53056 , < 29629dd7d37349e9fb605375a75de44ac8926ea9 (git) Affected: 7c26c20da5d420cde55618263be4aa2f6de53056 , < b73dfe1ea7be7a072482434643b517d7726f4c8d (git) Affected: 7c26c20da5d420cde55618263be4aa2f6de53056 , < 6f95b59520278a72df9905db791b7ea31375fbc1 (git) Affected: 7c26c20da5d420cde55618263be4aa2f6de53056 , < ff14cd44c85c20ad69479db73698185de291550c (git) Affected: 7c26c20da5d420cde55618263be4aa2f6de53056 , < 0abc73c8a40fd64ac1739c90bb4f42c418d27a5e (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mediatek/mtk_eth_soc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c2d76a9658a4dbfcf02f2693a97e2d5ff42197a",
"status": "affected",
"version": "7c26c20da5d420cde55618263be4aa2f6de53056",
"versionType": "git"
},
{
"lessThan": "29629dd7d37349e9fb605375a75de44ac8926ea9",
"status": "affected",
"version": "7c26c20da5d420cde55618263be4aa2f6de53056",
"versionType": "git"
},
{
"lessThan": "b73dfe1ea7be7a072482434643b517d7726f4c8d",
"status": "affected",
"version": "7c26c20da5d420cde55618263be4aa2f6de53056",
"versionType": "git"
},
{
"lessThan": "6f95b59520278a72df9905db791b7ea31375fbc1",
"status": "affected",
"version": "7c26c20da5d420cde55618263be4aa2f6de53056",
"versionType": "git"
},
{
"lessThan": "ff14cd44c85c20ad69479db73698185de291550c",
"status": "affected",
"version": "7c26c20da5d420cde55618263be4aa2f6de53056",
"versionType": "git"
},
{
"lessThan": "0abc73c8a40fd64ac1739c90bb4f42c418d27a5e",
"status": "affected",
"version": "7c26c20da5d420cde55618263be4aa2f6de53056",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mediatek/mtk_eth_soc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()\n\nReset eBPF program pointer to old_prog and do not decrease its ref-count\nif mtk_open routine in mtk_xdp_setup() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:26:44.036Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c2d76a9658a4dbfcf02f2693a97e2d5ff42197a"
},
{
"url": "https://git.kernel.org/stable/c/29629dd7d37349e9fb605375a75de44ac8926ea9"
},
{
"url": "https://git.kernel.org/stable/c/b73dfe1ea7be7a072482434643b517d7726f4c8d"
},
{
"url": "https://git.kernel.org/stable/c/6f95b59520278a72df9905db791b7ea31375fbc1"
},
{
"url": "https://git.kernel.org/stable/c/ff14cd44c85c20ad69479db73698185de291550c"
},
{
"url": "https://git.kernel.org/stable/c/0abc73c8a40fd64ac1739c90bb4f42c418d27a5e"
}
],
"title": "net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23284",
"datePublished": "2026-03-25T10:26:44.036Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T10:26:44.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23363 (GCVE-0-2026-23363)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
Check frame length before accessing the mgmt fields in
mt7925_mac_write_txwi_80211 in order to avoid a possible oob access.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 3356464e50e1ee15ba3c324ef6cc5a475c2e96e4
(git)
Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 2831a8c574545101e6d0df50785fccb16474eb3c (git) Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 22a6419a8b955df81082285543be3e61816c49b5 (git) Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < c41a9abd6ae31d130e8f332e7c8800c4c866234b (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3356464e50e1ee15ba3c324ef6cc5a475c2e96e4",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
},
{
"lessThan": "2831a8c574545101e6d0df50785fccb16474eb3c",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
},
{
"lessThan": "22a6419a8b955df81082285543be3e61816c49b5",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
},
{
"lessThan": "c41a9abd6ae31d130e8f332e7c8800c4c866234b",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()\n\nCheck frame length before accessing the mgmt fields in\nmt7925_mac_write_txwi_80211 in order to avoid a possible oob access."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:46.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3356464e50e1ee15ba3c324ef6cc5a475c2e96e4"
},
{
"url": "https://git.kernel.org/stable/c/2831a8c574545101e6d0df50785fccb16474eb3c"
},
{
"url": "https://git.kernel.org/stable/c/22a6419a8b955df81082285543be3e61816c49b5"
},
{
"url": "https://git.kernel.org/stable/c/c41a9abd6ae31d130e8f332e7c8800c4c866234b"
}
],
"title": "wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23363",
"datePublished": "2026-03-25T10:27:46.204Z",
"dateReserved": "2026-01-13T15:37:46.002Z",
"dateUpdated": "2026-03-25T10:27:46.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23346 (GCVE-0-2026-23346)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
arm64: io: Extract user memory type in ioremap_prot()
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/0xf8
| generic_access_phys+0x20c/0x2b8
| __access_remote_vm+0x46c/0x5b8
| access_remote_vm+0x18/0x30
| environ_read+0x238/0x3e8
| vfs_read+0xe4/0x2b0
| ksys_read+0xcc/0x178
| __arm64_sys_read+0x4c/0x68
Extract only the memory type from the user 'pgprot_t' in ioremap_prot()
and assert that we're being passed a user mapping, to protect us against
any changes in future that may require additional handling. To avoid
falsely flagging users of ioremap(), provide our own ioremap() macro
which simply wraps __ioremap_prot().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
893dea9ccd08dab924839354aba21d4ed7a9abc0 , < 3d64dcc0799c2d6921ba027716b7be721eb19fa8
(git)
Affected: 893dea9ccd08dab924839354aba21d4ed7a9abc0 , < d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a (git) Affected: 893dea9ccd08dab924839354aba21d4ed7a9abc0 , < 8f098037139b294050053123ab2bc0f819d08932 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/io.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d64dcc0799c2d6921ba027716b7be721eb19fa8",
"status": "affected",
"version": "893dea9ccd08dab924839354aba21d4ed7a9abc0",
"versionType": "git"
},
{
"lessThan": "d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a",
"status": "affected",
"version": "893dea9ccd08dab924839354aba21d4ed7a9abc0",
"versionType": "git"
},
{
"lessThan": "8f098037139b294050053123ab2bc0f819d08932",
"status": "affected",
"version": "893dea9ccd08dab924839354aba21d4ed7a9abc0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/io.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: io: Extract user memory type in ioremap_prot()\n\nThe only caller of ioremap_prot() outside of the generic ioremap()\nimplementation is generic_access_phys(), which passes a \u0027pgprot_t\u0027 value\ndetermined from the user mapping of the target \u0027pfn\u0027 being accessed by\nthe kernel. On arm64, the \u0027pgprot_t\u0027 contains all of the non-address\nbits from the pte, including the permission controls, and so we end up\nreturning a new user mapping from ioremap_prot() which faults when\naccessed from the kernel on systems with PAN:\n\n | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000\n | ...\n | Call trace:\n | __memcpy_fromio+0x80/0xf8\n | generic_access_phys+0x20c/0x2b8\n | __access_remote_vm+0x46c/0x5b8\n | access_remote_vm+0x18/0x30\n | environ_read+0x238/0x3e8\n | vfs_read+0xe4/0x2b0\n | ksys_read+0xcc/0x178\n | __arm64_sys_read+0x4c/0x68\n\nExtract only the memory type from the user \u0027pgprot_t\u0027 in ioremap_prot()\nand assert that we\u0027re being passed a user mapping, to protect us against\nany changes in future that may require additional handling. To avoid\nfalsely flagging users of ioremap(), provide our own ioremap() macro\nwhich simply wraps __ioremap_prot()."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:33.133Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d64dcc0799c2d6921ba027716b7be721eb19fa8"
},
{
"url": "https://git.kernel.org/stable/c/d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a"
},
{
"url": "https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"
}
],
"title": "arm64: io: Extract user memory type in ioremap_prot()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23346",
"datePublished": "2026-03-25T10:27:33.133Z",
"dateReserved": "2026-01-13T15:37:45.999Z",
"dateUpdated": "2026-03-25T10:27:33.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23290 (GCVE-0-2026-23290)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-03-25 16:49
VLAI?
EPSS
Title
net: usb: pegasus: validate USB endpoints
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: pegasus: validate USB endpoints
The pegasus driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 43d7c4114b1ec14f41f09306525d3b9382286fc1
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 95556b4e879711693c9865ba0938c148f62d5ea4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c3f1672eaea68c5cb6e1ec081cdb92045453218f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ee31ec8cf1eafeefa85ef934ba688d27f88bf0e2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/pegasus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43d7c4114b1ec14f41f09306525d3b9382286fc1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "95556b4e879711693c9865ba0938c148f62d5ea4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c3f1672eaea68c5cb6e1ec081cdb92045453218f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ee31ec8cf1eafeefa85ef934ba688d27f88bf0e2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "11de1d3ae5565ed22ef1f89d73d8f2d00322c699",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/pegasus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: validate USB endpoints\n\nThe pegasus driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it. If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:49:11.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43d7c4114b1ec14f41f09306525d3b9382286fc1"
},
{
"url": "https://git.kernel.org/stable/c/7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f"
},
{
"url": "https://git.kernel.org/stable/c/95556b4e879711693c9865ba0938c148f62d5ea4"
},
{
"url": "https://git.kernel.org/stable/c/c3f1672eaea68c5cb6e1ec081cdb92045453218f"
},
{
"url": "https://git.kernel.org/stable/c/ee31ec8cf1eafeefa85ef934ba688d27f88bf0e2"
},
{
"url": "https://git.kernel.org/stable/c/11de1d3ae5565ed22ef1f89d73d8f2d00322c699"
}
],
"title": "net: usb: pegasus: validate USB endpoints",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23290",
"datePublished": "2026-03-25T10:26:48.886Z",
"dateReserved": "2026-01-13T15:37:45.992Z",
"dateUpdated": "2026-03-25T16:49:11.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23319 (GCVE-0-2026-23319)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
The root cause of this bug is that when 'bpf_link_put' reduces the
refcount of 'shim_link->link.link' to zero, the resource is considered
released but may still be referenced via 'tr->progs_hlist' in
'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in
'bpf_shim_tramp_link_release' is deferred. During this window, another
process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'.
Based on Martin KaFai Lau's suggestions, I have created a simple patch.
To fix this:
Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'.
Only increment the refcount if it is not already zero.
Testing:
I verified the fix by adding a delay in
'bpf_shim_tramp_link_release' to make the bug easier to trigger:
static void bpf_shim_tramp_link_release(struct bpf_link *link)
{
/* ... */
if (!shim_link->trampoline)
return;
+ msleep(100);
WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link,
shim_link->trampoline, NULL));
bpf_trampoline_put(shim_link->trampoline);
}
Before the patch, running a PoC easily reproduced the crash(almost 100%)
with a call trace similar to KaiyanM's report.
After the patch, the bug no longer occurs even after millions of
iterations.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e , < 529e685e522b9d7fb379dbe6929dcdf520e34c8c
(git)
Affected: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e , < 9b02c5c4147f8af8ed783c8deb5df927a55c3951 (git) Affected: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e , < cfcfa0ca0212162aa472551266038e8fd6768cff (git) Affected: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e , < 3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2 (git) Affected: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e , < 4e8a0005d633a4adc98e3b65d5080f93b90d356b (git) Affected: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e , < 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/trampoline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "529e685e522b9d7fb379dbe6929dcdf520e34c8c",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "9b02c5c4147f8af8ed783c8deb5df927a55c3951",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "cfcfa0ca0212162aa472551266038e8fd6768cff",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "4e8a0005d633a4adc98e3b65d5080f93b90d356b",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "56145d237385ca0e7ca9ff7b226aaf2eb8ef368b",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/trampoline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nThe root cause of this bug is that when \u0027bpf_link_put\u0027 reduces the\nrefcount of \u0027shim_link-\u003elink.link\u0027 to zero, the resource is considered\nreleased but may still be referenced via \u0027tr-\u003eprogs_hlist\u0027 in\n\u0027cgroup_shim_find\u0027. The actual cleanup of \u0027tr-\u003eprogs_hlist\u0027 in\n\u0027bpf_shim_tramp_link_release\u0027 is deferred. During this window, another\nprocess can cause a use-after-free via \u0027bpf_trampoline_link_cgroup_shim\u0027.\n\nBased on Martin KaFai Lau\u0027s suggestions, I have created a simple patch.\n\nTo fix this:\n Add an atomic non-zero check in \u0027bpf_trampoline_link_cgroup_shim\u0027.\n Only increment the refcount if it is not already zero.\n\nTesting:\n I verified the fix by adding a delay in\n \u0027bpf_shim_tramp_link_release\u0027 to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link-\u003etrampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(\u0026shim_link-\u003elink,\n\t\tshim_link-\u003etrampoline, NULL));\n\tbpf_trampoline_put(shim_link-\u003etrampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM\u0027s report.\nAfter the patch, the bug no longer occurs even after millions of\niterations."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:13.678Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/529e685e522b9d7fb379dbe6929dcdf520e34c8c"
},
{
"url": "https://git.kernel.org/stable/c/9b02c5c4147f8af8ed783c8deb5df927a55c3951"
},
{
"url": "https://git.kernel.org/stable/c/cfcfa0ca0212162aa472551266038e8fd6768cff"
},
{
"url": "https://git.kernel.org/stable/c/3eeddb80191f7626ec1ef742bfff51ec3b0fa5c2"
},
{
"url": "https://git.kernel.org/stable/c/4e8a0005d633a4adc98e3b65d5080f93b90d356b"
},
{
"url": "https://git.kernel.org/stable/c/56145d237385ca0e7ca9ff7b226aaf2eb8ef368b"
}
],
"title": "bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23319",
"datePublished": "2026-03-25T10:27:13.678Z",
"dateReserved": "2026-01-13T15:37:45.995Z",
"dateUpdated": "2026-03-25T10:27:13.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23353 (GCVE-0-2026-23353)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
ice: fix crash in ethtool offline loopback test
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix crash in ethtool offline loopback test
Since the conversion of ice to page pool, the ethtool loopback test
crashes:
BUG: kernel NULL pointer dereference, address: 000000000000000c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1100f1067 P4D 0
Oops: Oops: 0002 [#1] SMP NOPTI
CPU: 23 UID: 0 PID: 5904 Comm: ethtool Kdump: loaded Not tainted 6.19.0-0.rc7.260128g1f97d9dcf5364.49.eln154.x86_64 #1 PREEMPT(lazy)
Hardware name: [...]
RIP: 0010:ice_alloc_rx_bufs+0x1cd/0x310 [ice]
Code: 83 6c 24 30 01 66 41 89 47 08 0f 84 c0 00 00 00 41 0f b7 dc 48 8b 44 24 18 48 c1 e3 04 41 bb 00 10 00 00 48 8d 2c 18 8b 04 24 <89> 45 0c 41 8b 4d 00 49 d3 e3 44 3b 5c 24 24 0f 83 ac fe ff ff 44
RSP: 0018:ff7894738aa1f768 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000700 RDI: 0000000000000000
RBP: 0000000000000000 R08: ff16dcae79880200 R09: 0000000000000019
R10: 0000000000000001 R11: 0000000000001000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ff16dcae6c670000
FS: 00007fcf428850c0(0000) GS:ff16dcb149710000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000000c CR3: 0000000121227005 CR4: 0000000000773ef0
PKRU: 55555554
Call Trace:
<TASK>
ice_vsi_cfg_rxq+0xca/0x460 [ice]
ice_vsi_cfg_rxqs+0x54/0x70 [ice]
ice_loopback_test+0xa9/0x520 [ice]
ice_self_test+0x1b9/0x280 [ice]
ethtool_self_test+0xe5/0x200
__dev_ethtool+0x1106/0x1a90
dev_ethtool+0xbe/0x1a0
dev_ioctl+0x258/0x4c0
sock_do_ioctl+0xe3/0x130
__x64_sys_ioctl+0xb9/0x100
do_syscall_64+0x7c/0x700
entry_SYSCALL_64_after_hwframe+0x76/0x7e
[...]
It crashes because we have not initialized libeth for the rx ring.
Fix it by treating ICE_VSI_LB VSIs slightly more like normal PF VSIs and
letting them have a q_vector. It's just a dummy, because the loopback
test does not use interrupts, but it contains a napi struct that can be
passed to libeth_rx_fq_create() called from ice_vsi_cfg_rxq() ->
ice_rxq_pp_create().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_base.c",
"drivers/net/ethernet/intel/ice/ice_ethtool.c",
"drivers/net/ethernet/intel/ice/ice_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "85c98b81849e4724ae99005a6cccd33cab9cfd18",
"status": "affected",
"version": "93f53db9f9dc4a16b40ecd18e6d338ad57e4b670",
"versionType": "git"
},
{
"lessThan": "a9c354e656597aededa027d63d2ff0973f6b033f",
"status": "affected",
"version": "93f53db9f9dc4a16b40ecd18e6d338ad57e4b670",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_base.c",
"drivers/net/ethernet/intel/ice/ice_ethtool.c",
"drivers/net/ethernet/intel/ice/ice_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0-rc3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix crash in ethtool offline loopback test\n\nSince the conversion of ice to page pool, the ethtool loopback test\ncrashes:\n\n BUG: kernel NULL pointer dereference, address: 000000000000000c\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 1100f1067 P4D 0\n Oops: Oops: 0002 [#1] SMP NOPTI\n CPU: 23 UID: 0 PID: 5904 Comm: ethtool Kdump: loaded Not tainted 6.19.0-0.rc7.260128g1f97d9dcf5364.49.eln154.x86_64 #1 PREEMPT(lazy)\n Hardware name: [...]\n RIP: 0010:ice_alloc_rx_bufs+0x1cd/0x310 [ice]\n Code: 83 6c 24 30 01 66 41 89 47 08 0f 84 c0 00 00 00 41 0f b7 dc 48 8b 44 24 18 48 c1 e3 04 41 bb 00 10 00 00 48 8d 2c 18 8b 04 24 \u003c89\u003e 45 0c 41 8b 4d 00 49 d3 e3 44 3b 5c 24 24 0f 83 ac fe ff ff 44\n RSP: 0018:ff7894738aa1f768 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000700 RDI: 0000000000000000\n RBP: 0000000000000000 R08: ff16dcae79880200 R09: 0000000000000019\n R10: 0000000000000001 R11: 0000000000001000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: ff16dcae6c670000\n FS: 00007fcf428850c0(0000) GS:ff16dcb149710000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000000000000c CR3: 0000000121227005 CR4: 0000000000773ef0\n PKRU: 55555554\n Call Trace:\n \u003cTASK\u003e\n ice_vsi_cfg_rxq+0xca/0x460 [ice]\n ice_vsi_cfg_rxqs+0x54/0x70 [ice]\n ice_loopback_test+0xa9/0x520 [ice]\n ice_self_test+0x1b9/0x280 [ice]\n ethtool_self_test+0xe5/0x200\n __dev_ethtool+0x1106/0x1a90\n dev_ethtool+0xbe/0x1a0\n dev_ioctl+0x258/0x4c0\n sock_do_ioctl+0xe3/0x130\n __x64_sys_ioctl+0xb9/0x100\n do_syscall_64+0x7c/0x700\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [...]\n\nIt crashes because we have not initialized libeth for the rx ring.\n\nFix it by treating ICE_VSI_LB VSIs slightly more like normal PF VSIs and\nletting them have a q_vector. It\u0027s just a dummy, because the loopback\ntest does not use interrupts, but it contains a napi struct that can be\npassed to libeth_rx_fq_create() called from ice_vsi_cfg_rxq() -\u003e\nice_rxq_pp_create()."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:38.167Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/85c98b81849e4724ae99005a6cccd33cab9cfd18"
},
{
"url": "https://git.kernel.org/stable/c/a9c354e656597aededa027d63d2ff0973f6b033f"
}
],
"title": "ice: fix crash in ethtool offline loopback test",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23353",
"datePublished": "2026-03-25T10:27:38.167Z",
"dateReserved": "2026-01-13T15:37:46.000Z",
"dateUpdated": "2026-03-25T10:27:38.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23333 (GCVE-0-2026-23333)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27
VLAI?
EPSS
Title
netfilter: nft_set_rbtree: validate open interval overlap
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: validate open interval overlap
[ Upstream commit 648946966a08e4cb1a71619e3d1b12bd7642de7b ]
Open intervals do not have an end element, in particular an open
interval at the end of the set is hard to validate because of it is
lacking the end element, and interval validation relies on such end
element to perform the checks.
This patch adds a new flag field to struct nft_set_elem, this is not an
issue because this is a temporary object that is allocated in the stack
from the insert/deactivate path. This flag field is used to specify that
this is the last element in this add/delete command.
The last flag is used, in combination with the start element cookie, to
check if there is a partial overlap, eg.
Already exists: 255.255.255.0-255.255.255.254
Add interval: 255.255.255.0-255.255.255.255
~~~~~~~~~~~~~
start element overlap
Basically, the idea is to check for an existing end element in the set
if there is an overlap with an existing start element.
However, the last open interval can come in any position in the add
command, the corner case can get a bit more complicated:
Already exists: 255.255.255.0-255.255.255.254
Add intervals: 255.255.255.0-255.255.255.255,255.255.255.0-255.255.255.254
~~~~~~~~~~~~~
start element overlap
To catch this overlap, annotate that the new start element is a possible
overlap, then report the overlap if the next element is another start
element that confirms that previous element in an open interval at the
end of the set.
For deletions, do not update the start cookie when deleting an open
interval, otherwise this can trigger spurious EEXIST when adding new
elements.
Unfortunately, there is no NFT_SET_ELEM_INTERVAL_OPEN flag which would
make easier to detect open interval overlaps.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6db2be971e3d70c9e3f85d39eff7103c2ee2f579",
"status": "affected",
"version": "7c84d41416d836ef7e533bd4d64ccbdf40c5ac70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: validate open interval overlap\n\n[ Upstream commit 648946966a08e4cb1a71619e3d1b12bd7642de7b ]\n\nOpen intervals do not have an end element, in particular an open\ninterval at the end of the set is hard to validate because of it is\nlacking the end element, and interval validation relies on such end\nelement to perform the checks.\n\nThis patch adds a new flag field to struct nft_set_elem, this is not an\nissue because this is a temporary object that is allocated in the stack\nfrom the insert/deactivate path. This flag field is used to specify that\nthis is the last element in this add/delete command.\n\nThe last flag is used, in combination with the start element cookie, to\ncheck if there is a partial overlap, eg.\n\n Already exists: 255.255.255.0-255.255.255.254\n Add interval: 255.255.255.0-255.255.255.255\n ~~~~~~~~~~~~~\n start element overlap\n\nBasically, the idea is to check for an existing end element in the set\nif there is an overlap with an existing start element.\n\nHowever, the last open interval can come in any position in the add\ncommand, the corner case can get a bit more complicated:\n\n Already exists: 255.255.255.0-255.255.255.254\n Add intervals: 255.255.255.0-255.255.255.255,255.255.255.0-255.255.255.254\n ~~~~~~~~~~~~~\n start element overlap\n\nTo catch this overlap, annotate that the new start element is a possible\noverlap, then report the overlap if the next element is another start\nelement that confirms that previous element in an open interval at the\nend of the set.\n\nFor deletions, do not update the start cookie when deleting an open\ninterval, otherwise this can trigger spurious EEXIST when adding new\nelements.\n\nUnfortunately, there is no NFT_SET_ELEM_INTERVAL_OPEN flag which would\nmake easier to detect open interval overlaps."
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:27:23.869Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6db2be971e3d70c9e3f85d39eff7103c2ee2f579"
}
],
"title": "netfilter: nft_set_rbtree: validate open interval overlap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23333",
"datePublished": "2026-03-25T10:27:23.869Z",
"dateReserved": "2026-01-13T15:37:45.997Z",
"dateUpdated": "2026-03-25T10:27:23.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…