{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:43:19.210360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:48:43.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b810352d0916796dabe633cdb9adee9863ab4911",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "aef5ea8578f97f2701039600846a8bcf5f21e863",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "3371f2036e0f970166bbb624e25bba46d32fa18e",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "665fb7d22a700c66a78db0cf88c6e6a649aba9d0",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "3525987a392536f31a484833af258971af63b24c",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "35744ab3d03c5fca8c1752f53fc8fc674e14c561",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix a use-after-free problem in rxe_mmap\n\nrxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list\nand releases pending_lock while the struct\u0027s kref is still at 1:\n\n   list_del_init(\u0026ip-\u003epending_mmaps);\n   spin_unlock_bh(\u0026rxe-\u003epending_lock);   /* ref == 1, no lock held */\n   ret = remap_vmalloc_range(vma, ip-\u003eobj, 0);  /* walks PTEs */\n   [...]\n   rxe_vma_open(vma);                    /* kref_get, ref \u2192 2 */\n   remap_vmalloc_range_partial() walks PTEs without any lock.\n\nA concurrent DESTROY_CQ ioctl on another CPU calls:\n\n    kref_put(\u0026q-\u003eip-\u003eref, rxe_mmap_release)   /* ref 1\u21920 */\n    vfree(ip-\u003eobj)   /* clears vmalloc PTEs mid-walk */\n    kfree(ip)        /* frees rxe_mmap_info */\n\nThis yields:\n\n   1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the\n   per-PTE race -\u003e vm_insert_page(NULL) \u2192 GPF in validate_page_before_insert\n\n   2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears\n   it. User VMA holds a PTE to a free\u0027d page which might eventually get\n   reallocated later by vmalloc which allows the attacker to get a clean\n   page-level UAF.\n\n   It is worth noting that even though a page-level UAF is possible given\n   the strong primitive, it is statistically very difficult to achieve\n   given the very short time window (after the last insert_page and before\n   the kref_get).\n\nThe call trace are as below:\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n  CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  RIP: 0010:validate_page_before_insert+0x32/0x300\n  Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5\n  RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202\n  RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008\n  RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00\n  R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20\n  FS:  00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0\n  Call Trace:\n   \u003cTASK\u003e\n   insert_page+0x8f/0x190\n   ? __pfx_insert_page+0x10/0x10\n   ? kasan_save_alloc_info+0x38/0x60\n   vm_insert_page+0x2e7/0x400\n   remap_vmalloc_range_partial+0x212/0x3e0\n   remap_vmalloc_range+0x6e/0xb0\n   ? __kasan_check_write+0x14/0x30\n   rxe_mmap+0x2e9/0x5d0\n   ib_uverbs_mmap+0x1ad/0x2c0\n   __mmap_region+0x12c2/0x2ad0\n   ? __pfx___mmap_region+0x10/0x10\n   ? __sanitizer_cov_trace_switch+0x58/0xb0\n   ? mas_prev_slot+0x360/0x39c0\n   ? __sanitizer_cov_trace_switch+0x58/0xb0\n   ? mas_next_slot+0x1e5b/0x2f40\n   ? __sanitizer_cov_trace_cmp8+0x18/0x30\n   ? unmapped_area_topdown+0x4dd/0x610\n   ? kfree+0x1b1/0x440\n   ? free_cpumask_var+0x16/0x30\n   ? __kasan_slab_free+0x7d/0xa0\n   ? __sanitizer_cov_trace_cmp8+0x18/0x30\n   mmap_region+0x2e6/0x3c0\n   do_mmap+0xa3e/0x12a0\n   ? __pfx_do_mmap+0x10/0x10\n   ? __kasan_check_write+0x14/0x30\n   ? down_write_killable+0xba/0x160\n   ? __pfx_down_write_killable+0x10/0x10\n   ? __sanitizer_cov_trace_cmp4+0x16/0x30\n   vm_mmap_pgoff+0x2d4/0x4a0\n   ? __pfx_vm_mmap_pgoff+0x10/0x10\n   ? fget+0x1bf/0x270\n   ksys_mmap_pgoff+0x40c/0x690\n   ? __sanitizer_cov_trace_const_cmp4+0x16/0x30\n   ? __pfx_ksys_mmap_pgoff+0x10/0x10\n   ? __kasan_check_write+0x14/0x30\n   ? _raw_spin_trylock+0xbb/0x130\n   ? __pfx__raw_spin_trylock+0x10/0x10\n   __x64_sys_mmap+0x135/0x1e0\n   x64_sys_c\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via local mmap on /dev/infiniband/uverbsN (ib_uverbs_mmap\u2192rxe_mmap) racing DESTROY_CQ/QP/SRQ ioctls; not reachable from RoCE/UDP packet processing.\nAC:L - Attacker controls both sides\u2014mmap of the pending CQ/QP/SRQ queue buffer and concurrent destroy that kref_puts to rxe_mmap_release\u2014and can retry unboundedly; PoC shows reliable crash.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbs* as 0666 with no capability checks on create/mmap/destroy; once Soft-RoCE exists (admin setup), any unprivileged user (PoC UID 1000) can exploit.\nUI:N - Attacker opens uverbs, creates a CQ/QP/SRQ, then races mmap with destroy from its own threads; no victim action required.\nS:U - UAF corrupts kernel heap/vmalloc within the host kernel authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Race frees rxe_mmap_info and vfree\u0027s the queue while remap_vmalloc_range still walks it; stale PTEs can leave a user VMA mapped to reallocated pages, enabling page-level UAF reads.\nI:H - Same page-level UAF / freed-object control yields write primitives via remapped freed pages and heap reuse, sufficient for control-flow hijacking per UAF guidance.\nA:H - Concurrent vfree during PTE walk returns NULL to vm_insert_page, causing the documented GPF/oops in validate_page_before_insert; crash is reliably repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:09.006Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911"
        },
        {
          "url": "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863"
        },
        {
          "url": "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e"
        },
        {
          "url": "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c"
        },
        {
          "url": "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561"
        }
      ],
      "title": "RDMA/rxe: Fix a use-after-free problem in rxe_mmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64582",
    "datePublished": "2026-08-05T11:25:29.082Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-10-19T20:48:43.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/bdc/bdc_core.c",
            "drivers/usb/gadget/udc/bdc/bdc_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eac1107e54679db2df2c36d8bba3b66d3ab6cbcd",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "0b0b76e31b3991a899ae724eb97d359de0c0f1b1",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "3fe181952b8a1aeb167d4503c794c0f5050f08ed",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "f6fc21ec7ccd83726ba766d73d0b8cc03e726475",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "dcf3e2f164435b5844706cb8eefef29ebee0eedb",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "d4964a74717107697999f48bcb4e80a9c0679a27",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            },
            {
              "lessThan": "0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb",
              "status": "affected",
              "version": "efed421a94e62a7ddbc76acba4312b70e4be958f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/udc/bdc/bdc_core.c",
            "drivers/usb/gadget/udc/bdc/bdc_udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n\nThe Broadcom BDC UDC driver registers its IRQ handler with\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm\nonly after bdc_remove() returns.  devm releases resources in reverse\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -\u003e\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -\u003e\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring\n(bdc-\u003esrr.sr_bds) and kfree()s bdc-\u003ebdc_ep_array.  Both happen while\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)\nremains deliverable in the window up to the post-remove devm\nfree_irq().\n\nOn receipt of a shared interrupt in that window, bdc_udc_interrupt()\ndereferences bdc-\u003esrr.sr_bds[bdc-\u003esrr.dqp_index] (NULL or freed DMA)\nand dispatches sr_handler callbacks that index into bdc_ep_array,\ncausing a NULL-deref or use-after-free.\n\nThe same window affects the delayed_work bdc-\u003efunc_wake_notify, which is\narmed from the IRQ handler via bdc_sr_uspc() -\u003e handle_link_state_change()\n-\u003e schedule_delayed_work() and may self-rearm from its own callback\nbdc_func_wake_timer().  No cancel exists anywhere in the driver, so a\nqueued work item that fires after bdc_remove() returns and the bdc\nstructure is devm-freed dereferences freed memory.\n\nReplace devm_request_irq() with request_irq() and add an explicit\nfree_irq(bdc-\u003eirq, bdc) in bdc_remove().  Clear BDC_GIE before\nfree_irq() to stop the device from asserting interrupts, then\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()\ndrains the func_wake_notify delayed work.  This ordering ensures the\nIRQ handler and delayed work cannot interfere with the subsequent\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit().  Wire the\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is\nreleased on probe failure, and route the bdc_init_ep() failure through\nerr0 instead of returning directly.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable window opens on local BDC platform-driver teardown (sysfs unbind/rmmod \u2192 bdc_remove), not on parsing USB host packets; that matches other USB gadget/UDC teardown UAFs scored AV:L and is higher severity than Physical.\nAC:L - The attacker controls remove/bind retries; a pending func_wake_notify (never cancelled before the fix) runs deterministically on the post-remove freed bdc, and IRQF_SHARED plus USB activity can also hit the IRQ window during teardown.\nPR:L - Highest reasonable exposure is a local account managing the gadget/UDC on Android or Broadcom STB systems where platform unbind is delegated beyond init-namespace root; uncertain Low vs High, so Low per the overestimate rule.\nUI:N - The attacker performs driver remove and any prior link-state activity that arms func_wake_notify themselves; no separate victim mount, open, or other interaction is required.\nS:U - NULL-deref/use-after-free of sr_bds, bdc_ep_array, and the delayed-work bdc object stays inside the host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of the DMA status-report ring, endpoint array, and the bdc object via IRQ/work handlers allows reclaim/spray and disclosure of kernel memory, which per UAF guidance is High.\nI:H - The same UAF paths write through freed endpoint/status structures and run delayed work on a freed bdc, enabling heap corruption and control-flow hijack suitable for privilege escalation.\nA:H - Dereferencing NULL/freed sr_bds in hard-IRQ context or executing bdc_func_wake_timer on a post-remove freed bdc causes kernel oops/panic, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:42.500Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eac1107e54679db2df2c36d8bba3b66d3ab6cbcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b0b76e31b3991a899ae724eb97d359de0c0f1b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fe181952b8a1aeb167d4503c794c0f5050f08ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a1d7158420df6b8fa1efc0cdd6ab704801a4fc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6fc21ec7ccd83726ba766d73d0b8cc03e726475"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcf3e2f164435b5844706cb8eefef29ebee0eedb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4964a74717107697999f48bcb4e80a9c0679a27"
        },
        {
          "url": "https://git.kernel.org/stable/c/0583f2fbf8f86ae3a0ce054f96783dd83e65d9bb"
        }
      ],
      "title": "usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64583",
    "datePublished": "2026-08-06T07:06:25.335Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-23T12:45:42.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3c6f2c38062703d3dc7f86958bb0790c6959add",
              "status": "affected",
              "version": "3635523e9b96213969693c320302d536774d8e9b",
              "versionType": "git"
            },
            {
              "lessThan": "df18150126f66817e4d3f79f309e9c92d6ff384e",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "620955b222c47332297d6bf38f78541aa699238a",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "87bc316dd6fc90072297c635e10b9aa6075ecda1",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "f45089eaad0a083d71d84ff175741d7e157d9b69",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "ac9a51d910bb7465c554c45320cb6c09f3d0b49d",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "5650c18d93a1db7e27cb5a40b394747eb4686d5b",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.291",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10.235",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.291",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of().  This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped.  In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream.  A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned.  A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns.  Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure.  opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by local configfs UDC clear or function unlink (unregister_gadget \u2192 f_midi_unbind/disable) plus ALSA rawmidi write/close on /dev/snd/midi*; no USB host traffic or cable access is required, and dummy_hcd suffices, matching other gadget teardown UAFs scored AV:L.\nAC:L - The attacker controls both sides of the race: opening/writing the rawmidi substream to queue midi-\u003ework via f_midi_in_trigger after disable, and forcing unbind plus dropping the last free_ref via configfs unlink/close, so the window is freely repeatable.\nPR:L - Exploitation needs access to the gadget configfs tree and/or the ALSA MIDI node; both are routinely delegated to non-root system/audio accounts on Android and embedded MIDI gadgets, with no capability check on the rawmidi write or UDC store path itself.\nUI:N - The attacker performs the full sequence\u2014configfs unbind/unlink, rawmidi write to rearm work, and close to free the midi object\u2014without any action by another user or administrator.\nS:U - The use-after-free corrupts kernel heap within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - f_midi_in_work() container_of()s the freed embedded work_struct and then reads midi-\u003ein_ep, fifo, and port/substream fields; reclaiming the freed f_midi slab yields a classic UAF read/disclosure primitive.\nI:H - Post-free f_midi_transmit()/f_midi_drop_out_substreams() write through the reclaimed object (port state, kfifo, snd_rawmidi_drop_output), giving a heap write-after-free primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed f_midi from system_highpri_wq reliably produces KASAN reports, oops, or kernel panic even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:12.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add"
        },
        {
          "url": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e"
        },
        {
          "url": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a"
        },
        {
          "url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b"
        }
      ],
      "title": "usb: gadget: f_midi: cancel pending IN work before freeing the midi object",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64584",
    "datePublished": "2026-08-06T07:06:25.953Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-19T16:29:12.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/esd_usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d12f6add48f2da15c8c8281961d3faad804c76cf",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            },
            {
              "lessThan": "aa1d005927db38af783c1a4a8a00a39e0229ab2d",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            },
            {
              "lessThan": "a02e1d8f191324583599544d54e59e6a2b74bb0e",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            },
            {
              "lessThan": "a3314f10369df70925140f59bbe069718f65a0b9",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            },
            {
              "lessThan": "765ba1c91823a296447528791b89a6504947fd5c",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            },
            {
              "lessThan": "5832c55b3c824ba2fe9c36ac3c411baddcce053e",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            },
            {
              "lessThan": "c43122fef328a70045fe7621c06de6b2b8e19264",
              "status": "affected",
              "version": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/esd_usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: esd_usb: kill anchored URBs before freeing netdevs\n\nesd_usb_disconnect() frees each CAN netdev with free_candev() inside\nits per-netdev loop and only calls unlink_all_urbs(dev) afterwards.\nThe per-netdev private data (struct esd_usb_net_priv) is embedded in\nthe net_device allocation returned by alloc_candev(), so once\nfree_candev() has run, dev-\u003enets[i] points to freed memory.\nunlink_all_urbs() then dereferences the freed dev-\u003enets[i] to kill the\nper-netdev TX anchor (usb_kill_anchored_urbs(\u0026priv-\u003etx_submitted)),\nclear active_tx_jobs, and reset priv-\u003etx_contexts[].\n\nReorder the teardown so the anchored URBs are killed before the netdevs\nare freed, matching other CAN/USB drivers in the same directory such as\nems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then\nfree: unregister the netdevs first (which stops their TX queues), call\nunlink_all_urbs(dev) once, then free the netdevs.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by forcing esd_usb_disconnect() via local usbfs USBDEVFS_DISCONNECT, sysfs unbind, or USB emulation, not by network/CAN traffic; this matches AV:L scoring of analogous USB disconnect UAFs (e.g. CVE-2025-40283).\nAC:L - Once disconnect runs, free_candev() then unlink_all_urbs() deterministically uses freed esd_usb_net_priv in the same teardown path; the attacker fully controls when unbind occurs, with no attacker-uncontrollable race required.\nPR:L - A basic local account with write access to the USB device node (plugdev/uaccess or USB passthrough) can issue USBDEVFS_DISCONNECT; that path has no CAP_SYS_ADMIN check, so init-namespace root is not required.\nUI:N - The attacker issues disconnect/unbind against an already-bound esd CAN-USB interface (or their own matching VID/PID device) without any separate victim action.\nS:U - The freed netdev-private object and subsequent URB teardown run entirely within the host kernel security authority; this is not a VM, IOMMU, or sandbox boundary escape.\nC:H - Use-after-free of struct esd_usb_net_priv (embedded in the freed candev) lets a reclaimed object supply attacker-controlled pointer-rich state read through usb_kill_anchored_urbs() and related teardown, enabling kernel disclosure.\nI:H - unlink_all_urbs() writes through the freed priv (usb_kill_anchored_urbs on tx_submitted, atomic_set of active_tx_jobs, and tx_contexts[] resets), giving a heap UAF write primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed per-netdev private data during disconnect reliably causes kernel oops/panic, and the attacker can repeat unbind/rebind to re-trigger the crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:43.597Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d12f6add48f2da15c8c8281961d3faad804c76cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264"
        }
      ],
      "title": "can: esd_usb: kill anchored URBs before freeing netdevs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64585",
    "datePublished": "2026-08-06T07:06:26.556Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-23T12:45:43.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:43:21.576355Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:48:43.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9dfb09cb0abbf92a06f93e0715e163aa188a84da",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "4824e3bcc68f8d678b409039d1bb48c7b5ea73dc",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "61127dd20920bf28460a1609aabb0dafa2f54fac",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "c268331845ee00dbdbccb000826bb612dff2bee7",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "e3815d1ffbb9be4f1605ddc3b427557893461683",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "02d378828af8bb74f6c2f4d2bee3c77cf16c861e",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "177a25be1195f8bdc6160ba5f1a5699f7041c985",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            },
            {
              "lessThan": "43b25879f004c98defa2776bedc6ca4763c51945",
              "status": "affected",
              "version": "4684997d9eea29380000e062755aa6d368d789a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: drain bus_reset work on device removal\n\nbrcmf_fw_crashed() and the debugfs \"reset\" entry both schedule\ndrvr-\u003ebus_reset, whose callback recovers drvr through container_of()\nand dereferences it.  The removal path frees drvr (brcmf_free -\u003e\nwiphy_free) without draining the work, so a bus_reset callback pending\nor running during removal can outlive drvr.\n\nCancellation cannot live in brcmf_detach() or brcmf_free(): the work\ncallback reaches teardown through the bus .reset op (PCIe\nbrcmf_pcie_reset -\u003e brcmf_detach; SDIO brcmf_sdio_bus_reset -\u003e\nbrcmf_sdiod_remove -\u003e brcmf_free), so cancelling there would wait for\nthe running work and deadlock.\n\nAdd a per-bus mutex (bus_reset_lock) and route all arming through\nbrcmf_bus_schedule_reset(), which under the lock skips when the bus is\nmarked removing.  Each bus remove entry calls\nbrcmf_bus_cancel_reset_work(), which under the same lock sets removing\nand cancels the work.  Holding the mutex across cancel_work_sync() makes\nthe set-removing + drain step atomic.  Every producer reaches the arming\npath from process context -- the PCIe firmware-halt notification runs in\nthe threaded IRQ handler (brcmf_pcie_isr_thread) and the SDIO hostmail\npath runs from the data workqueue -- so the mutex is taken only in\nsleepable contexts.  Where applicable the remove entry first stops the\nfirmware-crash producer: on PCIe mask the mailbox and synchronize_irq;\non SDIO unregister the bus interrupt and cancel the data worker, which\nalso reports firmware halts through brcmf_fw_crashed().  The mutex is\ninitialized at bus allocation.  The SDIO suspend power-off path frees\ndrvr through the same brcmf_sdiod_remove() and takes the same lock;\nresume re-allows the work only on a successful re-probe.\n\nAlso guard brcmf_fw_crashed() against a NULL bus_if/drvr: it can fire\nbefore brcmf_attach() wires up drvr, and it dereferences drvr\n(bphy_err/brcmf_dev_coredump) before reaching the arming gate.\n\nThe bus_reset work is shared across buses, so the drain is applied to\nevery remove path: PCIe (the .reset op introduced by the Fixes commit),\nSDIO (arms the same work through brcmf_fw_crashed()), and USB (via the\ndebugfs \"reset\" entry).  cancel_work_sync() drains a running or pending\nbus_reset work item before removal frees drvr, and patch 1/2 makes the\nscratch-buffer release safe when reset teardown has already released\nthose DMA buffers.\n\nThis patch fixes the lifetime of the bus_reset work item itself.  It does\nnot attempt to address the separate, pre-existing lifetime of the\nasynchronous firmware completion started by the PCIe reset path.  That\ncallback needs its own lifetime/ownership protocol and is being tracked\nseparately.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - bus_reset is armed by brcmf_fw_crashed() when Broadcom fullmac signals FWHALT (PCIe mailbox ISR thread / SDIO hostmail). An adjacent 802.11 attacker can induce that halt with malformed frames; the pending work then races device removal (USB hot-unplug, SDIO suspend power-off) that frees drvr without draining the work.\nAC:L - The attacker repeatedly induces firmware halts to schedule bus_reset and can align removal (USB unplug on shared dongles/kiosks, or SDIO suspend) so the work runs after wiphy_free; both sides are attacker-influenced and freely retryable, so success does not depend on uncontrollable timing.\nPR:N - FWHALT delivery and brcmf_fw_crashed() need no host credentials; concurrent free via USB disconnect or automatic SDIO power-cut suspend likewise requires no account or capability. The debugfs reset path is root-only but is not the highest-severity reachability.\nUI:N - Firmware-halt recovery and device removal/suspend paths run in kernel workqueues and bus callbacks without the victim opening a file, mounting media, or otherwise interacting.\nS:U - The UAF corrupts host-kernel heap (struct brcmf_pub embedded in the wiphy) within the same kernel security authority; it is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Use-after-free of drvr via container_of on the freed bus_reset work_struct lets an attacker reallocate the wiphy/drvr slab and observe attacker-controlled object contents through subsequent driver dereferences, yielding an arbitrary kernel read primitive.\nI:H - The recycled work_struct/drvr is dispatched by the workqueue (func pointer / bus_if ops), enabling heap corruption and control-flow hijack when brcmf_core_bus_reset runs on attacker-shaped memory after brcmf_free/wiphy_free.\nA:H - Even without full exploitation, running bus_reset after wiphy_free dereferences freed drvr/bus_if state and reliably causes kernel oops/panic or driver teardown failure, denying availability of the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:44.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9dfb09cb0abbf92a06f93e0715e163aa188a84da"
        },
        {
          "url": "https://git.kernel.org/stable/c/4824e3bcc68f8d678b409039d1bb48c7b5ea73dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/61127dd20920bf28460a1609aabb0dafa2f54fac"
        },
        {
          "url": "https://git.kernel.org/stable/c/c268331845ee00dbdbccb000826bb612dff2bee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3815d1ffbb9be4f1605ddc3b427557893461683"
        },
        {
          "url": "https://git.kernel.org/stable/c/02d378828af8bb74f6c2f4d2bee3c77cf16c861e"
        },
        {
          "url": "https://git.kernel.org/stable/c/177a25be1195f8bdc6160ba5f1a5699f7041c985"
        },
        {
          "url": "https://git.kernel.org/stable/c/43b25879f004c98defa2776bedc6ca4763c51945"
        }
      ],
      "title": "wifi: brcmfmac: drain bus_reset work on device removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64586",
    "datePublished": "2026-08-06T07:06:27.158Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-10-19T20:48:43.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/arc/emac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abd338da658d7faa8e26cfefc8f83f0066707564",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "5f29dd540fe5ea3c826fc8ec759ba488b31f9707",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "6fc7449773748c7b904235a09a67054d78ab1172",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "81431da777924dddaefa5c9b0ca9da4a93f9df96",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "d0f2386f529807826e7404d40a245ee428f89f62",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "8efd5dcd31e22a9308b16b107a052fcd568c0a99",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "8f9adb3605e36f75639de529bb3d66e94194a388",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            },
            {
              "lessThan": "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c",
              "status": "affected",
              "version": "e4f2379db6c6823c5d4a4c2c912df00c65de51d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/arc/emac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in ARC/Rockchip EMAC platform probe/teardown (arc_emac_probe \u2192 free_netdev while the devm IRQ remains), not in packet processing; a remote or adjacent peer cannot induce this path via Ethernet frames.\nAC:H - Exploitation needs leftover firmware/bootloader-latched EMAC IRQ state plus a post-request_irq probe failure overlapping interrupt delivery; the attacker does not control that hardware/firmware precondition or IRQ timing.\nPR:L - An unprivileged local user can drive post-request_irq failures such as dmam_alloc_coherent -ENOMEM via memory pressure during deferred probe after userspace is up; platform bind/unbind is root-only but is not required for this path.\nUI:N - No victim action is required; once leftover IRQ state exists, the attacker can induce probe failure and race teardown without another user opening or configuring the interface.\nS:U - Impact is use-after-free/corruption inside the host kernel EMAC interrupt path and does not cross a VM, IOMMU, or other separate security authority.\nC:H - arc_emac_intr can run on a freed or half-initialized net_device (netdev_priv, NAPI, stats), a use-after-free that can expose attacker-influenced kernel heap contents.\nI:H - The same UAF lets the IRQ handler write through reclaimed net_device/NAPI state (e.g. napi_schedule), enabling heap corruption and potential control-flow hijacking.\nA:H - Dereferencing freed or uninitialized NAPI/netdev state in IRQ context can oops or panic the kernel, causing full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T15:13:24.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f29dd540fe5ea3c826fc8ec759ba488b31f9707"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fc7449773748c7b904235a09a67054d78ab1172"
        },
        {
          "url": "https://git.kernel.org/stable/c/81431da777924dddaefa5c9b0ca9da4a93f9df96"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f2386f529807826e7404d40a245ee428f89f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/8efd5dcd31e22a9308b16b107a052fcd568c0a99"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f9adb3605e36f75639de529bb3d66e94194a388"
        },
        {
          "url": "https://git.kernel.org/stable/c/2503d08f8a2de618e5c3a8183b250ff4a2e2d52c"
        }
      ],
      "title": "net: ethernet: arc: emac: quiesce interrupts before requesting IRQ",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64587",
    "datePublished": "2026-08-06T07:06:27.765Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-08T15:13:24.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev_uring.c",
            "fs/fuse/dev_uring_i.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b156bb9966972122b148acab8bdf415cdb8176a3",
              "status": "affected",
              "version": "c2c9af9a0b13261c36909036057a116f2edb5e1a",
              "versionType": "git"
            },
            {
              "lessThan": "d01a09b442cb786cd44ccc7c84d57e2856d6737c",
              "status": "affected",
              "version": "c2c9af9a0b13261c36909036057a116f2edb5e1a",
              "versionType": "git"
            },
            {
              "lessThan": "46725a0056c884cf58a6897f222892807327d82d",
              "status": "affected",
              "version": "c2c9af9a0b13261c36909036057a116f2edb5e1a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev_uring.c",
            "fs/fuse/dev_uring_i.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: fix data races on ring-\u003eready\n\nOn weakly-ordered architectures, the store to fiq-\u003eops can be\nreordered past the store to ring-\u003eready, allowing a CPU that sees\nring-\u003eready == true via fuse_uring_ready() to dispatch requests\nthrough a stale fiq-\u003eops pointer. Upgrade the store to\nsmp_store_release() and the load in fuse_uring_ready() to\nsmp_load_acquire() so that the preceding WRITE_ONCE(fiq-\u003eops, ...)\nis visible to any CPU that observes ring-\u003eready == true.\n\nAdditionally, fuse_uring_do_register() publishes ring-\u003eready with\nWRITE_ONCE() but the fast-path check reads it with a plain load.\nThis is a marked-vs-unmarked access that KCSAN will flag. Wrap it in\nREAD_ONCE() to mark it without adding unnecessary ordering.\n\nAlso wrap the fc-\u003ering load in fuse_uring_ready() in READ_ONCE() to\nprevent the compiler from reloading it between the NULL check and the\ndereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached locally by mounting FUSE with io-uring and submitting IORING_OP_URING_CMD registration while other local threads generate FUSE requests; no network protocol path invokes fuse_uring_ready() or fuse_uring_do_register().\nAC:L - The attacker controls both sides of the race by registering ring entries on /dev/fuse while concurrently issuing filesystem operations on the same mount, so the publish window on weakly ordered CPUs can be driven and retried without relying on victim state.\nPR:L - FUSE is FS_USERNS_MOUNT, so an ordinary user can create a user-namespace mount, open /dev/fuse, and enable FUSE_OVER_IO_URING without init-namespace root privileges.\nUI:N - The attacker can run both the FUSE daemon that registers io-uring queues and the client threads that generate requests on that mount, so no separate victim action is required.\nS:U - Impact is confined to the host kernel authority as a local FUSE/io-uring memory-safety failure, not a VM, IOMMU, or guest-to-host boundary escape.\nC:H - Missing acquire on ring-\u003eready lets CPUs observe readiness while fiq-\u003eops and related ring publication are stale, and the unfixed fc-\u003ering reload in fuse_uring_ready() is a check-then-use UAF window against ring teardown, enabling disclosure of reclaimed kernel memory.\nI:H - Dispatching through inconsistent ops/ring state and the concurrent ring reload UAF allow writes and list/queue operations on stale or reallocated fuse_ring objects, which is exploitable for heap corruption and control-flow hijacking.\nA:H - The same races can NULL-dereference or use a freed fuse_ring in fuse_uring_task_to_queue()/fuse_uring_ready(), hang requests on the wrong queue path, and trigger WARN/oops or panic under panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:09.400Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b156bb9966972122b148acab8bdf415cdb8176a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d01a09b442cb786cd44ccc7c84d57e2856d6737c"
        },
        {
          "url": "https://git.kernel.org/stable/c/46725a0056c884cf58a6897f222892807327d82d"
        }
      ],
      "title": "fuse-uring: fix data races on ring-\u003eready",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64588",
    "datePublished": "2026-08-06T07:13:46.688Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-17T04:58:09.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-core-base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ce0a74bfa3acdfcdb00cf02f181f2754b451f42",
              "status": "affected",
              "version": "e19f31169f85c712c9fca35bfd28ceb093a9f574",
              "versionType": "git"
            },
            {
              "lessThan": "3351c5e77749a0c8a1e252b95420c143ebcf07ac",
              "status": "affected",
              "version": "3f8c4f5e9a57868fa107016c81165686d23325f2",
              "versionType": "git"
            },
            {
              "lessThan": "034e307428119b67f5f18a35e4f4e7d15a2b9774",
              "status": "affected",
              "version": "3f8c4f5e9a57868fa107016c81165686d23325f2",
              "versionType": "git"
            },
            {
              "lessThan": "2295d2bb101faa663fbc45fadbb3fec45f107441",
              "status": "affected",
              "version": "3f8c4f5e9a57868fa107016c81165686d23325f2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.96",
              "status": "affected",
              "version": "6.12.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-core-base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.12.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix NULL-deref on adapter registration failure\n\nIf adapter registration ever fails the release callback would trigger a\nNULL-pointer dereference as the completion struct has not been\ninitialised.\n\nNote that before the offending commit this would instead have resulted\nin a minor memory leak of the adapter name."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:10.524Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ce0a74bfa3acdfcdb00cf02f181f2754b451f42"
        },
        {
          "url": "https://git.kernel.org/stable/c/3351c5e77749a0c8a1e252b95420c143ebcf07ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/034e307428119b67f5f18a35e4f4e7d15a2b9774"
        },
        {
          "url": "https://git.kernel.org/stable/c/2295d2bb101faa663fbc45fadbb3fec45f107441"
        }
      ],
      "title": "i2c: core: fix NULL-deref on adapter registration failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64589",
    "datePublished": "2026-08-06T07:13:47.291Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-17T04:58:10.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/udmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a7c644e632741c2a3116a0d3da6c11de957a6ba",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "01126abc11bcc6a45b664293b0b5df715be911d7",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "dd7f1e572f44d3d039dc77e3989f537196c3bf52",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "0db56e7eae932f8e2f3eb44ad1a63633d8f504f8",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "d6552f5cff795d60e629f37513ecf23d88fd2f82",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "34696563461c9a23177feb6d8aff43f4c0510278",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "0449a6583c0ee76778d314e4e82f166fc97fa9d8",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            },
            {
              "lessThan": "504e2b4ab97a51d56d966cd36d0997ad30b65b2d",
              "status": "affected",
              "version": "284562e1f34874e267d4f499362c3816f8f6bc3f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/udmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning\n\nWhen CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM\ndriver (e.g. amdgpu for video playback in GNOME Videos / Showtime)\ntriggers a spurious warning:\n\n  DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \\\n      overlapping mappings aren\u0027t supported\n  WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0\n\nThe call chain is:\n\n  amdgpu_cs_ioctl\n   -\u003e amdgpu_ttm_backend_bind\n    -\u003e dma_buf_map_attachment\n     -\u003e [udmabuf] map_udmabuf -\u003e get_sg_table\n      -\u003e dma_map_sgtable(dev, sg, direction, 0)  // attrs=0\n       -\u003e debug_dma_map_sg -\u003e add_dma_entry -\u003e EEXIST\n\nThis happens because udmabuf builds a per-page scatter-gather list via\nsg_set_folio().  When begin_cpu_udmabuf() has already created an sg\ntable mapped for the misc device, and an importer such as amdgpu maps\nthe same pages for its own device via map_udmabuf(), the DMA debug\ninfrastructure sees two active mappings whose physical addresses share\ncacheline boundaries and warns about the overlap.\n\nThe DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in\nadd_dma_entry() because it signals that no CPU cache maintenance is\nperformed at map/unmap time, making the cacheline overlap harmless.\n\nAll other major dma-buf exporters already pass this flag:\n  - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC\n  - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC\n\nThe CPU sync at map/unmap time is also redundant for udmabuf:\nbegin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit\ncache synchronization via dma_sync_sgtable_for_cpu/device() when CPU\naccess is requested through the dma-buf interface.\n\nPass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and\ndma_unmap_sgtable() in udmabuf to suppress the spurious warning and\nskip the redundant sync."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:45.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a7c644e632741c2a3116a0d3da6c11de957a6ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/01126abc11bcc6a45b664293b0b5df715be911d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd7f1e572f44d3d039dc77e3989f537196c3bf52"
        },
        {
          "url": "https://git.kernel.org/stable/c/0db56e7eae932f8e2f3eb44ad1a63633d8f504f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6552f5cff795d60e629f37513ecf23d88fd2f82"
        },
        {
          "url": "https://git.kernel.org/stable/c/34696563461c9a23177feb6d8aff43f4c0510278"
        },
        {
          "url": "https://git.kernel.org/stable/c/0449a6583c0ee76778d314e4e82f166fc97fa9d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/504e2b4ab97a51d56d966cd36d0997ad30b65b2d"
        }
      ],
      "title": "dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64590",
    "datePublished": "2026-08-06T07:13:47.888Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-23T12:45:45.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb354384f40bb087e7c44f0f0743a23fc945f91d",
              "status": "affected",
              "version": "ee312bb1052e45cbccaf6abac1012db9ca43150a",
              "versionType": "git"
            },
            {
              "lessThan": "477f8dec3b5ae54e8ef3c33bdd2257e47896512e",
              "status": "affected",
              "version": "39c20c4e83b9f78988541d829aa34668904e54a0",
              "versionType": "git"
            },
            {
              "lessThan": "534b5f98ab7319d8004bbc7dab6481462243e883",
              "status": "affected",
              "version": "39c20c4e83b9f78988541d829aa34668904e54a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "46461dabb95239aa05e31e247cd21151b8406642",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.39",
              "status": "affected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.h",
            "drivers/iommu/intel/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid WARNING in sva unbind path\n\nThe Intel IOMMU driver allows SVA on devices even if they do not support\nPCI/PRI. Commit 39c20c4e83b9 (\"iommu/vt-d: Only handle IOPF for SVA when\nPRI is supported\") modified the SVA bind path to allow this configuration\nby skipping IOPF enablement when PRI is missing. However, it failed to\nupdate the unbind path.\n\nThis creates an imbalance: the unbind path attempts to disable IOPF for\na device that never had it enabled, triggering a WARNING in\nintel_iommu_disable_iopf():\n\n WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d\n Call Trace:\n  \u003cTASK\u003e\n  blocking_domain_set_dev_pasid+0x50/0x70\n  iommu_detach_device_pasid+0x89/0xc0\n  iommu_sva_unbind_device+0x73/0x150\n  xe_vm_close_and_put+0x4d2/0x1200 [xe]\n\nFix this by bypassing IOPF operations for SVA domains on non-PRI hardware\nin both the bind and unbind paths."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:12.761Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb354384f40bb087e7c44f0f0743a23fc945f91d"
        },
        {
          "url": "https://git.kernel.org/stable/c/477f8dec3b5ae54e8ef3c33bdd2257e47896512e"
        },
        {
          "url": "https://git.kernel.org/stable/c/534b5f98ab7319d8004bbc7dab6481462243e883"
        }
      ],
      "title": "iommu/vt-d: Avoid WARNING in sva unbind path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64591",
    "datePublished": "2026-08-06T07:13:48.490Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-17T04:58:12.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}