Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18355 vulnerabilities
CVE-2026-99087 (GCVE-0-2026-99087)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the
user activates the device in the 'R' mode, a crash in dm_integrity_resume
happens because the function attempts to read the journal containing the
bitmap.
This patch makes dm-integrity skip any writes to the device in
dm_integrity_resume if the device is activated in the 'R' mode.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 2e25842f0e4423e0efb243f56153d842ed6b933f
(git)
Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 69ed43ed8a174465fca1ba6bfbde53e4618c8956 (git) Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2e25842f0e4423e0efb243f56153d842ed6b933f",
"status": "affected",
"version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
"versionType": "git"
},
{
"lessThan": "69ed43ed8a174465fca1ba6bfbde53e4618c8956",
"status": "affected",
"version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
"versionType": "git"
},
{
"lessThan": "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84",
"status": "affected",
"version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the \u0027R\u0027 mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the \u0027R\u0027 mode."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:05.714Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f"
},
{
"url": "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956"
},
{
"url": "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"
}
],
"title": "dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99087",
"datePublished": "2026-10-23T12:45:05.714Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:05.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99086 (GCVE-0-2026-99086)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
dm-integrity: validate the superblock on resume
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: validate the superblock on resume
dm_integrity_resume() re-reads the superblock from the device so that it
picks up the flags and the recalculate position. It performs no
validation on the result, while the constructor validates the superblock
it reads and sizes all the in-memory structures according to it. The user
may modify the superblock on the underlying device while the dm-integrity
device is suspended, so that the two no longer agree.
In particular, access_journal_data() shifts the journal entry index by
ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the
journal page list were computed with the value that was present at
constructor time. Increasing log2_sectors_per_block makes the index run
past the end of the journal, and dm-integrity then writes 512 bytes
through lowmem_page_address(NULL).
Snapshot the validated superblock in the constructor and refuse to resume
if any of the fields that describe the on-disk geometry changed.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
38625191f32f77a9d5fc7cc15f4f9b78768bfb33 , < 454b67fcc28c18502e47dfb9f067b04c28628ada
(git)
Affected: 118ba36e446c01e3cd34b3eedabf1d9436525e1d , < e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e (git) Affected: 118ba36e446c01e3cd34b3eedabf1d9436525e1d , < fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2 (git) Affected: 824b9c27d7b600520b95f0cab95a47d1b08a9483 (git) Affected: fb49f209995f729053c6ee728436f98d78a49b6f (git) Affected: c6138af1f5454c2631a837916fda958ea72c0d71 (git) Affected: 3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f (git) Affected: 6.18.16 , < 6.18.58 (semver) Affected: 6.1.165 , < 6.2 (semver) Affected: 6.6.128 , < 6.7 (semver) Affected: 6.12.75 , < 6.13 (semver) Affected: 6.19.6 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "454b67fcc28c18502e47dfb9f067b04c28628ada",
"status": "affected",
"version": "38625191f32f77a9d5fc7cc15f4f9b78768bfb33",
"versionType": "git"
},
{
"lessThan": "e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e",
"status": "affected",
"version": "118ba36e446c01e3cd34b3eedabf1d9436525e1d",
"versionType": "git"
},
{
"lessThan": "fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2",
"status": "affected",
"version": "118ba36e446c01e3cd34b3eedabf1d9436525e1d",
"versionType": "git"
},
{
"status": "affected",
"version": "824b9c27d7b600520b95f0cab95a47d1b08a9483",
"versionType": "git"
},
{
"status": "affected",
"version": "fb49f209995f729053c6ee728436f98d78a49b6f",
"versionType": "git"
},
{
"status": "affected",
"version": "c6138af1f5454c2631a837916fda958ea72c0d71",
"versionType": "git"
},
{
"status": "affected",
"version": "3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f",
"versionType": "git"
},
{
"lessThan": "6.18.58",
"status": "affected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.18.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic-\u003esb-\u003elog2_sectors_per_block, while ic-\u003ejournal_section_sectors and the\njournal page list were computed with the value that was present at\nconstructor time. Increasing log2_sectors_per_block makes the index run\npast the end of the journal, and dm-integrity then writes 512 bytes\nthrough lowmem_page_address(NULL).\n\nSnapshot the validated superblock in the constructor and refuse to resume\nif any of the fields that describe the on-disk geometry changed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:04.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada"
},
{
"url": "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e"
},
{
"url": "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"
}
],
"title": "dm-integrity: validate the superblock on resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99086",
"datePublished": "2026-10-23T12:45:04.496Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:04.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99085 (GCVE-0-2026-99085)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
A CPU going down has to empty its own rq. Its hotplug thread waits in
sched_cpu_wait_empty() until nothing else is left, and the only thing that
wakes it is balance_push(), which runs from __schedule() on the dying CPU
and pushes off the migratable tasks the CPU picks.
sched_ext breaks this. A task sitting on a user DSQ or held by the BPF
scheduler is still counted on its rq, but an inactive CPU no longer calls
ops.dispatch() and can't pull the task back. The dying CPU goes idle with
the task still counted, and one of two things happens:
- Another CPU consumes the task. The rq empties without a __schedule() on
the dying CPU, so the hotplug thread is never woken and cpu_down() hangs
holding cpu_hotplug_lock.
- The task is affine only to the dying CPU. Nothing can move it, and the
offline stalls until the watchdog ejects the BPF scheduler.
When the rq goes offline, re-enqueue every task on it that isn't already on
the local DSQ. An enqueue on an offline rq lands on the local DSQ, so the
dying CPU itself picks the tasks and balance_push() pushes them off, the
same as for the other sched classes. From then on no sched_ext path on
another CPU can pull a task off the rq.
ops.dispatch() currently stops as soon as the CPU goes inactive, and CPU
hotplug then waits for an RCU grace period before taking the rq offline. A
BPF-held task affine only to the dying CPU and preempted inside an RCU
read-side critical section would block that grace period, and the rq would
never go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps
running until the rq goes offline. Only the dying CPU's own hotplug thread
clears the flag during teardown, and task_can_run_on_remote_rq() still keeps
other rqs' tasks off the CPU.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f0e1a0643a59bf1f922fa209cec86a170b784f3f , < f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c
(git)
Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 638ee6bca19750934ea13f9c325f46fd8ae60064 (git) Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 173ff9d03ec6373c3158b6e630af33a9b36fd216 (git) Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < d35a535d3e3e71f92a051d94e415f43612c4edfc (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "638ee6bca19750934ea13f9c325f46fd8ae60064",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "173ff9d03ec6373c3158b6e630af33a9b36fd216",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "d35a535d3e3e71f92a051d94e415f43612c4edfc",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can\u0027t pull the task back. The dying CPU goes idle with\nthe task still counted, and one of two things happens:\n\n- Another CPU consumes the task. The rq empties without a __schedule() on\n the dying CPU, so the hotplug thread is never woken and cpu_down() hangs\n holding cpu_hotplug_lock.\n- The task is affine only to the dying CPU. Nothing can move it, and the\n offline stalls until the watchdog ejects the BPF scheduler.\n\nWhen the rq goes offline, re-enqueue every task on it that isn\u0027t already on\nthe local DSQ. An enqueue on an offline rq lands on the local DSQ, so the\ndying CPU itself picks the tasks and balance_push() pushes them off, the\nsame as for the other sched classes. From then on no sched_ext path on\nanother CPU can pull a task off the rq.\n\nops.dispatch() currently stops as soon as the CPU goes inactive, and CPU\nhotplug then waits for an RCU grace period before taking the rq offline. A\nBPF-held task affine only to the dying CPU and preempted inside an RCU\nread-side critical section would block that grace period, and the rq would\nnever go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps\nrunning until the rq goes offline. Only the dying CPU\u0027s own hotplug thread\nclears the flag during teardown, and task_can_run_on_remote_rq() still keeps\nother rqs\u0027 tasks off the CPU."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:03.465Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c"
},
{
"url": "https://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064"
},
{
"url": "https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216"
},
{
"url": "https://git.kernel.org/stable/c/d35a535d3e3e71f92a051d94e415f43612c4edfc"
}
],
"title": "sched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99085",
"datePublished": "2026-10-23T12:45:03.465Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:03.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99084 (GCVE-0-2026-99084)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
readdir: take no inode lock on an immutable directory
Summary
In the Linux kernel, the following vulnerability has been resolved:
readdir: take no inode lock on an immutable directory
iterate_dir() takes the directory's i_rwsem shared and holds it across
->iterate_shared(). For a directory that never has an entry and is
never removed the lock keeps nothing still, it only orders every reader
and every writer of that inode behind each other.
For the directory of a nullfs instance that matters. The instance of
the initial mount namespace is the root of every empty mount namespace
and the private instance is the root of every kernel thread, so one
inode is shared across users who have nothing else in common. And a
reader can hold the lock for as long as it likes: back the getdents()
buffer with a mapping of a file on a FUSE mount of your own, let the
copy of "." and ".." fault and let the server wait. Queue an exclusive
taker behind it, a mkdir() in that directory goes through start_dirop()
before the read-only mount is reported, and from then on every lookup
that misses the dcache in that directory, every create and every mount
on it waits until the server answers. One user of an empty mount
namespace stalls all the others.
Add FOP_IMMUTABLE for the file operations of a directory that never
changes and is never removed and let iterate_dir() skip the lock for
it. The flag never changes for a file, ->f_pos is protected by
f_pos_lock since directories are FMODE_ATOMIC_POS, IS_DEADDIR can't be
set on such a directory and neither touch_atime() nor fsnotify take
i_rwsem. Set it on the nullfs directory. The placeholder directories of
libfs never have an entry either but their owners remove them, so they
keep the lock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9d4e752a24f740b31ca827bfab07010e4e7f34b0 , < 6d30b399ae28e5166d62484f81ccaefde6fe7996
(git)
Affected: 9d4e752a24f740b31ca827bfab07010e4e7f34b0 , < e08f57a7dcb83818c058e415988c23beb6c5a47f (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nullfs.c",
"fs/readdir.c",
"include/linux/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d30b399ae28e5166d62484f81ccaefde6fe7996",
"status": "affected",
"version": "9d4e752a24f740b31ca827bfab07010e4e7f34b0",
"versionType": "git"
},
{
"lessThan": "e08f57a7dcb83818c058e415988c23beb6c5a47f",
"status": "affected",
"version": "9d4e752a24f740b31ca827bfab07010e4e7f34b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nullfs.c",
"fs/readdir.c",
"include/linux/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nreaddir: take no inode lock on an immutable directory\n\niterate_dir() takes the directory\u0027s i_rwsem shared and holds it across\n-\u003eiterate_shared(). For a directory that never has an entry and is\nnever removed the lock keeps nothing still, it only orders every reader\nand every writer of that inode behind each other.\n\nFor the directory of a nullfs instance that matters. The instance of\nthe initial mount namespace is the root of every empty mount namespace\nand the private instance is the root of every kernel thread, so one\ninode is shared across users who have nothing else in common. And a\nreader can hold the lock for as long as it likes: back the getdents()\nbuffer with a mapping of a file on a FUSE mount of your own, let the\ncopy of \".\" and \"..\" fault and let the server wait. Queue an exclusive\ntaker behind it, a mkdir() in that directory goes through start_dirop()\nbefore the read-only mount is reported, and from then on every lookup\nthat misses the dcache in that directory, every create and every mount\non it waits until the server answers. One user of an empty mount\nnamespace stalls all the others.\n\nAdd FOP_IMMUTABLE for the file operations of a directory that never\nchanges and is never removed and let iterate_dir() skip the lock for\nit. The flag never changes for a file, -\u003ef_pos is protected by\nf_pos_lock since directories are FMODE_ATOMIC_POS, IS_DEADDIR can\u0027t be\nset on such a directory and neither touch_atime() nor fsnotify take\ni_rwsem. Set it on the nullfs directory. The placeholder directories of\nlibfs never have an entry either but their owners remove them, so they\nkeep the lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:02.631Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d30b399ae28e5166d62484f81ccaefde6fe7996"
},
{
"url": "https://git.kernel.org/stable/c/e08f57a7dcb83818c058e415988c23beb6c5a47f"
}
],
"title": "readdir: take no inode lock on an immutable directory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99084",
"datePublished": "2026-10-23T12:45:02.631Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:02.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99083 (GCVE-0-2026-99083)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 59c6dcc5dd9dafe764ca0d40525933b2be69b059
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 517404e157395d0f8da125ca956c566895dfcd06 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4722d06b2907585074252061b1024a696c1cfc23 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 23a0be6a84a38ac169eeab49017934e8e27c65f0 (git) Affected: 0 , < 6.6.160 (semver) Affected: 0 , < 6.12.114 (semver) Affected: 0 , < 6.18.58 (semver) Affected: 0 , < 7.2.12 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.160 , ≤ 6.6.*
(semver)
Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59c6dcc5dd9dafe764ca0d40525933b2be69b059",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "517404e157395d0f8da125ca956c566895dfcd06",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4722d06b2907585074252061b1024a696c1cfc23",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "23a0be6a84a38ac169eeab49017934e8e27c65f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.58",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:01.735Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059"
},
{
"url": "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a"
},
{
"url": "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"
},
{
"url": "https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23"
},
{
"url": "https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0"
}
],
"title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99083",
"datePublished": "2026-10-23T12:45:01.735Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:01.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99082 (GCVE-0-2026-99082)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-10-23 12:45
VLAI
EPSS
VEX
Title
KVM: x86: Use active memslots for the per-vCPU MMIO cache
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use active memslots for the per-vCPU MMIO cache
KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information. Both the fill and
validation paths use kvm_memslots(), which unconditionally selects address
space 0, even when the vCPU is running in SMM and using address space 1.
Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
memslot generation to the cache key so that a memslot update could not
leave a stale entry valid. When commit 699023e23965 ("KVM: x86: add SMM
to the MMU role, support SMRAM address space") added the SMM address space,
these helpers were not converted to use the active memslots.
Consequently, an update to the SMM memslots can leave an entry from the old
SMM address space apparently valid after the vCPU returns to the normal
address space. A guest can then cause an access to valid RAM at the same
GFN to be returned to userspace as KVM_EXIT_MMIO.
Completing that exit through the VMM's RAM address space writes the backing
page without going through KVM's write-tracking path. If the page backs a
nested EPT table, KVM can continue using shadow translations derived from
the old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
catches this invalid cache and memslot combination.
Use the vCPU's active memslots when caching and validating the entry.
Memslot generations are unique across address spaces, so the generation
also distinguishes the normal and SMM views. This matches the MMIO SPTE
cache, which already uses kvm_vcpu_memslots().
On an unpatched current-mainline kernel, a regression test that fills the
cache in SMM and updates only the SMM memslots fails the intended RAM write
and triggers the kvm_mmu_write_protect_fault() warning. With this change,
the same test completes the RAM write without a warning. The x86/smm_test,
set_memory_region_test, and memslot_modification_stress_test selftests also
pass.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < a63f79d9da9468952396af73e1e53330845cf876
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 2566780c684c9c21241d409d790087c73070f312 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < e792a9ace39d2812a5b342a1987186c7bc653204 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < b3e6212dea2e4328a841ceb37f377583176dc735 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.58 , ≤ 6.18.* (semver) Unaffected: 7.2.12 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a63f79d9da9468952396af73e1e53330845cf876",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "2566780c684c9c21241d409d790087c73070f312",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "e792a9ace39d2812a5b342a1987186c7bc653204",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "b3e6212dea2e4328a841ceb37f377583176dc735",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information. Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid. When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space. A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM\u0027s RAM address space writes the backing\npage without going through KVM\u0027s write-tracking path. If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU\u0027s active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views. This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning. With this change,\nthe same test completes the RAM write without a warning. The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:00.798Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876"
},
{
"url": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd"
},
{
"url": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"
},
{
"url": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204"
},
{
"url": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735"
}
],
"title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99082",
"datePublished": "2026-10-23T12:45:00.798Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:00.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99081 (GCVE-0-2026-99081)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
bnxt_en: fix DMA mapping length for padded small packets
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fix DMA mapping length for padded small packets
Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:
DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
[fault reason 0x06] PTE Read access is not set
bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
...
NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out
The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.
In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:
if (length < BNXT_MIN_PKT_SIZE) {
pad = BNXT_MIN_PKT_SIZE - length;
if (skb_pad(skb, pad))
goto tx_kick_pending;
length = BNXT_MIN_PKT_SIZE;
}
mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
...
dma_unmap_len_set(tx_buf, len, len);
However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.
Later, the hardware TX buffer descriptor is programmed with the padded length:
txbd->tx_bd_len_flags_type =
cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
TX_BD_FLAGS_PACKET_END);
The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.
This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.
Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,
because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so
that dma_map_single() maps the full buffer and the descriptor length is
consistent. This also removes the temporary 'pad' variable and masking logic.
The padding is done after the SW USO branch, otherwise
bnxt_sw_udp_gso_xmit() would account the padding as UDP payload
and send it in extra segments.
Note that SW USO segments are still not padded: with IPv4, a segment
carrying less than 10 bytes of UDP payload (small gso_size, or a short
last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.
This is a separate issue, left for a followup patch.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c0c050c58d840994ba842ad1c338a98e7c12b764 , < cf8530a25ae92c4493e2f22981ecb46f0b66f4c8
(git)
Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < 2956aca14dd2977cd08bd2ccafae3beb8b84b268 (git) Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < fbd977e513971ccb4f0762a7f59eac500e474f89 (git) Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < 5213f65a9667d3dd85db2e6df8f2e0516290db34 (git) Affected: c0c050c58d840994ba842ad1c338a98e7c12b764 , < a51d233ccd4889aadb71dace863525cc2b00271e (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf8530a25ae92c4493e2f22981ecb46f0b66f4c8",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "2956aca14dd2977cd08bd2ccafae3beb8b84b268",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "fbd977e513971ccb4f0762a7f59eac500e474f89",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "5213f65a9667d3dd85db2e6df8f2e0516290db34",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
},
{
"lessThan": "a51d233ccd4889aadb71dace863525cc2b00271e",
"status": "affected",
"version": "c0c050c58d840994ba842ad1c338a98e7c12b764",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length \u003c BNXT_MIN_PKT_SIZE) {\n pad = BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length = BNXT_MIN_PKT_SIZE;\n }\n\n mapping = dma_map_single(\u0026pdev-\u003edev, skb-\u003edata, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, \u0027len\u0027 was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd-\u003etx_bd_len_flags_type =\n cpu_to_le32(((len + pad) \u003c\u003c TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb-\u003edata ends near the boundary of a 4KB\npage (within \u0027pad\u0027 bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb-\u003edata\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)-\u003enr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb-\u003elen and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary \u0027pad\u0027 variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:28.347Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8"
},
{
"url": "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268"
},
{
"url": "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"
},
{
"url": "https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34"
},
{
"url": "https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e"
}
],
"title": "bnxt_en: fix DMA mapping length for padded small packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99081",
"datePublished": "2026-10-23T12:23:28.347Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:23:28.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99080 (GCVE-0-2026-99080)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
fs: Free any excess xarray nodes in clear_inode()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs: Free any excess xarray nodes in clear_inode()
For many years we've had a hard to hit leak of xarray nodes. Hugh
documented it well in commit 786b31121a2c. Recently people and
syzbot have found ways to force it to happen with madvise. Rather
than fix the leaks where they happen, just call xa_destroy() which
has the side-effect of cycling the i_pages lock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f1c966eb6ed5e190c90a56c5bdaa69967de39f21
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 21f51434c47d8628b62275ae6c6ad6b573abcd02 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 50cff3f112d64db6e5f57355f79bc837db8fe132 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 43f830e2bb84b22ca824b20bb861d823ecb520bd (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ee3f011250104129893d8e9599147e457d4d7280 (git) Affected: 0 , < 6.6.160 (semver) Affected: 0 , < 6.12.113 (semver) Affected: 0 , < 6.18.57 (semver) Affected: 0 , < 7.2.11 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.160 , ≤ 6.6.*
(semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1c966eb6ed5e190c90a56c5bdaa69967de39f21",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "21f51434c47d8628b62275ae6c6ad6b573abcd02",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "50cff3f112d64db6e5f57355f79bc837db8fe132",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "43f830e2bb84b22ca824b20bb861d823ecb520bd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ee3f011250104129893d8e9599147e457d4d7280",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.57",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Free any excess xarray nodes in clear_inode()\n\nFor many years we\u0027ve had a hard to hit leak of xarray nodes. Hugh\ndocumented it well in commit 786b31121a2c. Recently people and\nsyzbot have found ways to force it to happen with madvise. Rather\nthan fix the leaks where they happen, just call xa_destroy() which\nhas the side-effect of cycling the i_pages lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:27.393Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1c966eb6ed5e190c90a56c5bdaa69967de39f21"
},
{
"url": "https://git.kernel.org/stable/c/21f51434c47d8628b62275ae6c6ad6b573abcd02"
},
{
"url": "https://git.kernel.org/stable/c/50cff3f112d64db6e5f57355f79bc837db8fe132"
},
{
"url": "https://git.kernel.org/stable/c/43f830e2bb84b22ca824b20bb861d823ecb520bd"
},
{
"url": "https://git.kernel.org/stable/c/ee3f011250104129893d8e9599147e457d4d7280"
}
],
"title": "fs: Free any excess xarray nodes in clear_inode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99080",
"datePublished": "2026-10-23T12:23:27.393Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:23:27.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99079 (GCVE-0-2026-99079)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
net/mlx5e: Prevent stale XSK buffer release on refill retry
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on refill retry
When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before
allocating a replacement. If that refill succeeds only partially, a WQE
left without a replacement retains its old buffer pointer.
The buffer can meanwhile be allocated to another WQE. A later refill
retry can then free the live buffer through the stale pointer and publish
the same UMEM frame twice.
Mark the WQE as released immediately after the driver-side free. The flag
is already cleared when a replacement buffer is assigned, so refill
retries no longer release stale pointers.
The failure is silent and produces no kernel warning or splat. A
standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP
traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914
packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64
ownership/double-publication errors. With this change it processed
356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,
with no ownership or data errors.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 32bbb870078d467479965c21bbc4960c57eea208
(git)
Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 34d1db2b18e1c1d189e34dd51923e031815f88e3 (git) Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 639522e5056cade578a324acfa993ec6c9f7f5dc (git) Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < 655f47477054d19de3b138840be229a1a4490d0c (git) Affected: 3f93f82988bc6b4104314bf9aa485d47fbb7e241 , < e01620844c5c88b6fcf819d171df8e3976a0e76f (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "32bbb870078d467479965c21bbc4960c57eea208",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "34d1db2b18e1c1d189e34dd51923e031815f88e3",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "639522e5056cade578a324acfa993ec6c9f7f5dc",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "655f47477054d19de3b138840be229a1a4490d0c",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
},
{
"lessThan": "e01620844c5c88b6fcf819d171df8e3976a0e76f",
"status": "affected",
"version": "3f93f82988bc6b4104314bf9aa485d47fbb7e241",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on refill retry\n\nWhen an XDP redirect to an AF_XDP socket fails because its RX ring is\nfull, the XSK core frees the buffer. During the subsequent batched refill\nof a legacy cyclic RQ, mlx5e also releases the WQE\u0027s XSK buffer before\nallocating a replacement. If that refill succeeds only partially, a WQE\nleft without a replacement retains its old buffer pointer.\n\nThe buffer can meanwhile be allocated to another WQE. A later refill\nretry can then free the live buffer through the stale pointer and publish\nthe same UMEM frame twice.\n\nMark the WQE as released immediately after the driver-side free. The flag\nis already cleared when a replacement buffer is assigned, so refill\nretries no longer release stale pointers.\n\nThe failure is silent and produces no kernel warning or splat. A\nstandalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP\ntraffic offered at 12 Mpps, detected it: stock stopped after 2,854,914\npackets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64\nownership/double-publication errors. With this change it processed\n356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,\nwith no ownership or data errors."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:26.458Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/32bbb870078d467479965c21bbc4960c57eea208"
},
{
"url": "https://git.kernel.org/stable/c/34d1db2b18e1c1d189e34dd51923e031815f88e3"
},
{
"url": "https://git.kernel.org/stable/c/639522e5056cade578a324acfa993ec6c9f7f5dc"
},
{
"url": "https://git.kernel.org/stable/c/655f47477054d19de3b138840be229a1a4490d0c"
},
{
"url": "https://git.kernel.org/stable/c/e01620844c5c88b6fcf819d171df8e3976a0e76f"
}
],
"title": "net/mlx5e: Prevent stale XSK buffer release on refill retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99079",
"datePublished": "2026-10-23T12:23:26.458Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:26.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99078 (GCVE-0-2026-99078)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4c2a1323680709078736a2886c754004e9fe42e6 , < f3a52e2ec2788a7f6b64137985c087188a54ad4f
(git)
Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < d215d09606b0fcd18ad1eb532995782a21cea49d (git) Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < 867119b4b588037724b85839d534465f0334d9bd (git) Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < 3d73a1164a8c6b4461907a65cb6c022ea4fd39af (git) Affected: 4c2a1323680709078736a2886c754004e9fe42e6 , < 63811edf512584c946e5e96b100e9e280703bbb5 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3a52e2ec2788a7f6b64137985c087188a54ad4f",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "d215d09606b0fcd18ad1eb532995782a21cea49d",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "867119b4b588037724b85839d534465f0334d9bd",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "3d73a1164a8c6b4461907a65cb6c022ea4fd39af",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
},
{
"lessThan": "63811edf512584c946e5e96b100e9e280703bbb5",
"status": "affected",
"version": "4c2a1323680709078736a2886c754004e9fe42e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry\n\nWith AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until\nan MPWQE is refilled. If XSK allocation then returns -ENOMEM,\nactual_wq_head is not advanced and a later NAPI poll retries the same\nWQE.\n\nmlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On\nretry it can therefore call xsk_buff_free() again through stale pointers\nafter the frames have returned to the XSK pool and been reallocated.\n\nSet all skip_release_bitmap bits in the common error path of\nmlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A\nsuccessful allocation already clears the bitmap after replacing every\nbuffer, so retries become idempotent without changing the success path.\n\nFault injection forced three consecutive failures for one selected MPWQE.\nBoth an early allocation failure and a partial 8-of-16-buffer unwind\nreleased the original 16 XSK buffers only once. Each error left a full\nbitmap, the following NAPI retry skipped the release, and a later\nsuccessful allocation cleared it. A 20-second AF_XDP zero-copy pressure\nrun exercised 1,575,262 buffer allocation failures without invalid\ndescriptors, WQE errors, or kernel warnings."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:25.542Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3a52e2ec2788a7f6b64137985c087188a54ad4f"
},
{
"url": "https://git.kernel.org/stable/c/d215d09606b0fcd18ad1eb532995782a21cea49d"
},
{
"url": "https://git.kernel.org/stable/c/867119b4b588037724b85839d534465f0334d9bd"
},
{
"url": "https://git.kernel.org/stable/c/3d73a1164a8c6b4461907a65cb6c022ea4fd39af"
},
{
"url": "https://git.kernel.org/stable/c/63811edf512584c946e5e96b100e9e280703bbb5"
}
],
"title": "net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99078",
"datePublished": "2026-10-23T12:23:25.542Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:25.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99077 (GCVE-0-2026-99077)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: udp: Create exceptions before socket matching
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: udp: Create exceptions before socket matching
Currently, when ICMP Fragmentation Needed and Redirect Message packets
are locally delivered and quote a UDP packet, a FIB nexthop exception
(FNHE) is only created if the kernel can match the UDP packet to an
existing socket.
This behavior allows off-path attackers to conduct a side-channel attack
on the FNHE cache in order to discover the ephemeral port used by a
connected UDP socket.
Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache
less predictible") tried to mitigate such attacks by making it harder
for attackers to discover hash collisions in the FNHE cache and by
randomizing the number of exceptions a hash bucket can hold,
respectively. Unfortunately, both of the mitigations can be bypassed.
Instead, mitigate such attacks by always creating a FNHE, even before
trying to find a matching socket. Do that by calling ipv4_update_pmtu()
and ipv4_redirect(), the helpers used when the quoted packet did not
originate from a socket.
This means that guesses (right or wrong) from an off-path attacker will
always result in a FNHE being created or updated in the cache that the
attacker can observe.
Pass an oif of 0, in a similar fashion to icmp_err(). This is also the
oif used by the socket path for sockets that are not bound to a device.
Note that this does not allow attackers to create FNHEs that they could
not create before, as both helpers can already be reached with little to
no validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.
Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ipv4_sk_update_pmtu() /
ipv4_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the FNHE cache of the nexthop resolved by the no socket helpers and
another in the FNHE cache of the nexthop used by the socket.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4895c771c7f006b4b90f9d6b1d2210939ba57b38 , < be4fd05398f2b5e42029be70ee875fc749b8ce3a
(git)
Affected: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 , < 4c3499f79f8c7e8561266bcc220a18538cec0458 (git) |
|
| Linux | Linux |
Affected:
3.6
Unaffected: 0 , < 3.6 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be4fd05398f2b5e42029be70ee875fc749b8ce3a",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "4c3499f79f8c7e8561266bcc220a18538cec0458",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in the FNHE cache of the nexthop used by the socket."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:22.773Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a"
},
{
"url": "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"
}
],
"title": "ipv4: udp: Create exceptions before socket matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99077",
"datePublished": "2026-10-23T12:23:22.773Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:22.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99076 (GCVE-0-2026-99076)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv6: udp: Create exceptions before socket matching
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: udp: Create exceptions before socket matching
Currently, when ICMPv6 Packet Too Big and Redirect Message packets are
locally delivered and quote a UDP packet, an exception is only created
in the IPv6 exception cache if the kernel can match the UDP packet to an
existing socket.
This behavior allows off-path attackers to conduct a side-channel attack
on the exception cache in order to discover the ephemeral port used by a
connected UDP socket.
Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and
commit a00df2caffed ("ipv6: make exception cache less predictible") tried
to mitigate such attacks by making it harder for attackers to discover
hash collisions in the exception cache and by randomizing the number of
exceptions a hash bucket can hold, respectively. Unfortunately, both of
the mitigations can be bypassed.
Instead, mitigate such attacks by always creating an exception, even
before trying to find a matching socket. Do that by calling
ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted
packet did not originate from a socket.
This means that guesses (right or wrong) from an off-path attacker will
always result in an exception being created or updated in the cache that
the attacker can observe.
Pass the ifindex of the ingress device and the default uid, in a similar
fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any
nexthop in ip6_redirect_nh_match() and no exception would be created in
response to a Redirect Message.
Note that this does not allow attackers to create exceptions that they
could not create before, as both helpers can already be reached with
little to no validation. For example, by sending an ICMPv6 error that
quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that
matches a wildcard socket.
Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ip6_sk_update_pmtu() /
ip6_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the exception cache of the nexthop resolved by the no socket helpers
and another in the exception cache of the nexthop used by the socket.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < 8c9b310c958be33ba8fb9d0e6b77811d013e10c0
(git)
Affected: 2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < ac76cab50e899a7346408b8d3c3a4192c2eefb9f (git) |
|
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c9b310c958be33ba8fb9d0e6b77811d013e10c0",
"status": "affected",
"version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
"versionType": "git"
},
{
"lessThan": "ac76cab50e899a7346408b8d3c3a4192c2eefb9f",
"status": "affected",
"version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less predictible\") tried\nto mitigate such attacks by making it harder for attackers to discover\nhash collisions in the exception cache and by randomizing the number of\nexceptions a hash bucket can hold, respectively. Unfortunately, both of\nthe mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating an exception, even\nbefore trying to find a matching socket. Do that by calling\nip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted\npacket did not originate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in an exception being created or updated in the cache that\nthe attacker can observe.\n\nPass the ifindex of the ingress device and the default uid, in a similar\nfashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any\nnexthop in ip6_redirect_nh_match() and no exception would be created in\nresponse to a Redirect Message.\n\nNote that this does not allow attackers to create exceptions that they\ncould not create before, as both helpers can already be reached with\nlittle to no validation. For example, by sending an ICMPv6 error that\nquotes an ICMPv6 Echo Reply or one that quotes a UDP source port that\nmatches a wildcard socket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ip6_sk_update_pmtu() /\nip6_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the exception cache of the nexthop resolved by the no socket helpers\nand another in the exception cache of the nexthop used by the socket."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:19.727Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0"
},
{
"url": "https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"
}
],
"title": "ipv6: udp: Create exceptions before socket matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99076",
"datePublished": "2026-10-23T12:23:19.727Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:19.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99075 (GCVE-0-2026-99075)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
rust_binder: reschedule node refcount update on thread exit
Summary
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: reschedule node refcount update on thread exit
When a thread exits via BINDER_THREAD_EXIT, its pending work items are
cancelled. If a thread exits while holding a pending node refcount
increment (e.g. pushed as deferred work to that thread), the refcount
increment was previously dropped because Node::cancel() and
NodeWrapper::cancel() were no-ops.
Dropping the refcount update leaves the node's delivery state and count
state desynchronized, and userspace will not receive the notification,
which can cause the node to never be freed from the process's nodes tree
when all external references are dropped.
Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper
to move the pending refcount update to the process's work queue on thread
exit so another thread can deliver it to userspace.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 71cbad138969edecef01b28dff87d91b56db538d
(git)
Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1 (git) Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 2a74ccd1bcc170e66525f34e9de8652b57e2cf3d (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/android/binder/node.rs",
"drivers/android/binder/node/wrapper.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "71cbad138969edecef01b28dff87d91b56db538d",
"status": "affected",
"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"versionType": "git"
},
{
"lessThan": "fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1",
"status": "affected",
"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"versionType": "git"
},
{
"lessThan": "2a74ccd1bcc170e66525f34e9de8652b57e2cf3d",
"status": "affected",
"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/android/binder/node.rs",
"drivers/android/binder/node/wrapper.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: reschedule node refcount update on thread exit\n\nWhen a thread exits via BINDER_THREAD_EXIT, its pending work items are\ncancelled. If a thread exits while holding a pending node refcount\nincrement (e.g. pushed as deferred work to that thread), the refcount\nincrement was previously dropped because Node::cancel() and\nNodeWrapper::cancel() were no-ops.\n\nDropping the refcount update leaves the node\u0027s delivery state and count\nstate desynchronized, and userspace will not receive the notification,\nwhich can cause the node to never be freed from the process\u0027s nodes tree\nwhen all external references are dropped.\n\nFix this by implementing DeliverToRead::cancel() for Node and NodeWrapper\nto move the pending refcount update to the process\u0027s work queue on thread\nexit so another thread can deliver it to userspace."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:18.830Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/71cbad138969edecef01b28dff87d91b56db538d"
},
{
"url": "https://git.kernel.org/stable/c/fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1"
},
{
"url": "https://git.kernel.org/stable/c/2a74ccd1bcc170e66525f34e9de8652b57e2cf3d"
}
],
"title": "rust_binder: reschedule node refcount update on thread exit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99075",
"datePublished": "2026-10-23T12:23:18.830Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:18.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99074 (GCVE-0-2026-99074)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: stop PMTU walk when nexthop group shrinks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop PMTU walk when nexthop group shrinks
Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if
multipath enabled") made __ip_rt_update_pmtu() update every path.
For nexthop objects, fib_info_num_path() and fib_info_nhc()
independently load nh->nh_grp. RCU protects each group's lifetime but
does not make the loads observe the same group. If replacement shrinks
the group after the loop accepts an index, fib_info_nhc() returns NULL
and update_or_create_fnhe() dereferences it.
A deterministic probe only widened the existing window between the real
operations. On v7.2, an RTM_NEWNEXTHOP replacement published a
one-member group after the PMTU reader accepted index 1 from a two-member
group, producing:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: update_or_create_fnhe+0x45/0x15b0
Stop when the indexed path is absent. Groups are dense, so no later
index exists in that snapshot. The same real-writer window completed
114,423 PMTU iterations without an oops with this check. A reproducer
is available on request.
Replacement requires CAP_NET_ADMIN in the network namespace. Where
unprivileged user namespaces are permitted, a local user can obtain it
in a new user and network namespace.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3bed2abab4a682d426624ce9add9d7b6d475d4e4 , < 7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a
(git)
Affected: 7f5005457b3072fe1ddf15bfef869f2a1d98e05e , < c60d17d6dd61adc761ac6f65a008fefbc54cbf87 (git) Affected: 7d3f3b4367f315a61fc615e3138f3d320da8c466 , < c6d670ac656badfd0e15355e07a13a6bdf3b69fd (git) Affected: 7d3f3b4367f315a61fc615e3138f3d320da8c466 , < f27483f9975b5065ff67054cc7eb8edac6083488 (git) Affected: 7d3f3b4367f315a61fc615e3138f3d320da8c466 , < 6619e01855e65ef35723685a557e3eb106f4ecf5 (git) Affected: fc07a232326a623d0be482e307c08ea7049c2846 (git) Affected: b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e (git) Affected: 6.6.79 , < 6.6.160 (semver) Affected: 6.12.16 , < 6.12.113 (semver) Affected: 5.15.179 , < 5.16 (semver) Affected: 6.1.129 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a",
"status": "affected",
"version": "3bed2abab4a682d426624ce9add9d7b6d475d4e4",
"versionType": "git"
},
{
"lessThan": "c60d17d6dd61adc761ac6f65a008fefbc54cbf87",
"status": "affected",
"version": "7f5005457b3072fe1ddf15bfef869f2a1d98e05e",
"versionType": "git"
},
{
"lessThan": "c6d670ac656badfd0e15355e07a13a6bdf3b69fd",
"status": "affected",
"version": "7d3f3b4367f315a61fc615e3138f3d320da8c466",
"versionType": "git"
},
{
"lessThan": "f27483f9975b5065ff67054cc7eb8edac6083488",
"status": "affected",
"version": "7d3f3b4367f315a61fc615e3138f3d320da8c466",
"versionType": "git"
},
{
"lessThan": "6619e01855e65ef35723685a557e3eb106f4ecf5",
"status": "affected",
"version": "7d3f3b4367f315a61fc615e3138f3d320da8c466",
"versionType": "git"
},
{
"status": "affected",
"version": "fc07a232326a623d0be482e307c08ea7049c2846",
"versionType": "git"
},
{
"status": "affected",
"version": "b1f7bdee5750d6cbb9497140cd6582abc5fdcb9e",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.79",
"versionType": "semver"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "6.12.16",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.179",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.129",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.129",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh-\u003enh_grp. RCU protects each group\u0027s lifetime but\ndoes not make the loads observe the same group. If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\noperations. On v7.2, an RTM_NEWNEXTHOP replacement published a\none-member group after the PMTU reader accepted index 1 from a two-member\ngroup, producing:\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: update_or_create_fnhe+0x45/0x15b0\n\nStop when the indexed path is absent. Groups are dense, so no later\nindex exists in that snapshot. The same real-writer window completed\n114,423 PMTU iterations without an oops with this check. A reproducer\nis available on request.\n\nReplacement requires CAP_NET_ADMIN in the network namespace. Where\nunprivileged user namespaces are permitted, a local user can obtain it\nin a new user and network namespace."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:17.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7fd60d3c9a1e1b11ef5f1643bbae78d91eae2f4a"
},
{
"url": "https://git.kernel.org/stable/c/c60d17d6dd61adc761ac6f65a008fefbc54cbf87"
},
{
"url": "https://git.kernel.org/stable/c/c6d670ac656badfd0e15355e07a13a6bdf3b69fd"
},
{
"url": "https://git.kernel.org/stable/c/f27483f9975b5065ff67054cc7eb8edac6083488"
},
{
"url": "https://git.kernel.org/stable/c/6619e01855e65ef35723685a557e3eb106f4ecf5"
}
],
"title": "ipv4: stop PMTU walk when nexthop group shrinks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99074",
"datePublished": "2026-10-23T12:23:17.866Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:17.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99073 (GCVE-0-2026-99073)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: stop exception dump when nexthop group shrinks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop exception dump when nexthop group shrinks
Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU
protection") allowed IPv4 FIB dumps to run concurrently with nexthop
replacement.
fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,
then fib_info_nhc() independently reloads nh->nh_grp. If
RTM_NEWNEXTHOP replaces a group with fewer paths between those loads,
fib_info_nhc() returns NULL and the dump dereferences it through
nhc_flags.
Stop the walk when the indexed path is absent. Nexthop groups are
dense, so the current snapshot has no later path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4ce5dc9316de50e0da84beafe55d1344f829cece , < f91e472821e32f58b03eb631e20a67157e2b928b
(git)
Affected: 4ce5dc9316de50e0da84beafe55d1344f829cece , < 21cba134c30c17ae55f468b5809336437df5d7e6 (git) Affected: 4ce5dc9316de50e0da84beafe55d1344f829cece , < b9a30bb7b831e8c5a47fadbdf1760918aaf009cc (git) Affected: 4ce5dc9316de50e0da84beafe55d1344f829cece , < 4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f91e472821e32f58b03eb631e20a67157e2b928b",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
},
{
"lessThan": "21cba134c30c17ae55f468b5809336437df5d7e6",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
},
{
"lessThan": "b9a30bb7b831e8c5a47fadbdf1760918aaf009cc",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
},
{
"lessThan": "4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2",
"status": "affected",
"version": "4ce5dc9316de50e0da84beafe55d1344f829cece",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:16.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f91e472821e32f58b03eb631e20a67157e2b928b"
},
{
"url": "https://git.kernel.org/stable/c/21cba134c30c17ae55f468b5809336437df5d7e6"
},
{
"url": "https://git.kernel.org/stable/c/b9a30bb7b831e8c5a47fadbdf1760918aaf009cc"
},
{
"url": "https://git.kernel.org/stable/c/4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2"
}
],
"title": "ipv4: stop exception dump when nexthop group shrinks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99073",
"datePublished": "2026-10-23T12:23:16.935Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:16.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99072 (GCVE-0-2026-99072)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: stop route notification sizing when nexthop group shrinks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: stop route notification sizing when nexthop group shrinks
Commit 680aea08e78c ("net: ipv4: Emit notification when fib
hardware flags are changed") added an RCU-only fib_nlmsg_size() call
for asynchronous hardware flag notifications.
fib_nlmsg_size() checks fib_info_num_path() before each iteration,
then fib_info_nhc() independently reloads nh->nh_grp. If
RTM_NEWNEXTHOP replaces a group with fewer paths between those loads,
fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences
it.
Stop sizing when the indexed path is absent. Nexthop groups are
dense, so the current snapshot has no later path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
680aea08e78c003292415518ad270bc20f9c80b1 , < 72d9d17092bb37b0717f12042a0817d01a1f9e78
(git)
Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < d3daa33c7af92e38f2274bbd2576f58bfbaf89e6 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72d9d17092bb37b0717f12042a0817d01a1f9e78",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "d3daa33c7af92e38f2274bbd2576f58bfbaf89e6",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:15.735Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72d9d17092bb37b0717f12042a0817d01a1f9e78"
},
{
"url": "https://git.kernel.org/stable/c/ad1c9f1b98c92609e9bb2ae8f05916defc3b0a54"
},
{
"url": "https://git.kernel.org/stable/c/c1f48d1c2d5e9efd904dbbc2f2b3d41543e55c49"
},
{
"url": "https://git.kernel.org/stable/c/ad2b3a68b8a7d5d27de88e05674e4adb1ce46d88"
},
{
"url": "https://git.kernel.org/stable/c/d3daa33c7af92e38f2274bbd2576f58bfbaf89e6"
}
],
"title": "ipv4: stop route notification sizing when nexthop group shrinks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99072",
"datePublished": "2026-10-23T12:23:15.735Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:15.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99071 (GCVE-0-2026-99071)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv4: do not warn on route notification size race
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: do not warn on route notification size race
Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware
flags are changed") added asynchronous route notifications for hardware
flag changes.
fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later
fills it with fib_dump_info() while holding only RCU. With nexthop
compatibility mode enabled, a concurrent replacement can grow the group
between these independent snapshots. fib_dump_info() can then
legitimately return -EMSGSIZE, so the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and
reports the error to listeners.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
680aea08e78c003292415518ad270bc20f9c80b1 , < 088ba80eef85fa7a5ad8f9e7c82b403c99242b56
(git)
Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < 78a1cf5c54b2f795c81fedb530755a8d01cc84f0 (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < 7dfa7ca97f3ac46353edd4cc44f7733758e4535b (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < 221ef5e1e44a044790f0f54e6aa237883f475a4d (git) Affected: 680aea08e78c003292415518ad270bc20f9c80b1 , < e02a5b6588161673ef75a4bc5cdfb62bd493374d (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "088ba80eef85fa7a5ad8f9e7c82b403c99242b56",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "78a1cf5c54b2f795c81fedb530755a8d01cc84f0",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "7dfa7ca97f3ac46353edd4cc44f7733758e4535b",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "221ef5e1e44a044790f0f54e6aa237883f475a4d",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
},
{
"lessThan": "e02a5b6588161673ef75a4bc5cdfb62bd493374d",
"status": "affected",
"version": "680aea08e78c003292415518ad270bc20f9c80b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:14.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/088ba80eef85fa7a5ad8f9e7c82b403c99242b56"
},
{
"url": "https://git.kernel.org/stable/c/78a1cf5c54b2f795c81fedb530755a8d01cc84f0"
},
{
"url": "https://git.kernel.org/stable/c/7dfa7ca97f3ac46353edd4cc44f7733758e4535b"
},
{
"url": "https://git.kernel.org/stable/c/221ef5e1e44a044790f0f54e6aa237883f475a4d"
},
{
"url": "https://git.kernel.org/stable/c/e02a5b6588161673ef75a4bc5cdfb62bd493374d"
}
],
"title": "ipv4: do not warn on route notification size race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99071",
"datePublished": "2026-10-23T12:23:14.297Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:14.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99070 (GCVE-0-2026-99070)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ipv6: do not warn on route notification size race
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: do not warn on route notification size race
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later
fills it with rt6_fill_node(). With nexthop compatibility mode enabled,
a concurrent replacement can grow the group between these independent
snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so
the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and
reports the error to listeners.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
907eea486888cfe118c19759bbc4b8fca2e004df , < 8a3b935b6b6037eefb36bd27a60793a008358e8d
(git)
Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < 7b112bd43f1172fb152e848570a957467008a5ae (git) Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < 4ac7d92a4698e34e614c254359665b9de1f65283 (git) Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < 291fe0bafee78c95f9f2e7f579f17793fd5a1e5a (git) Affected: 907eea486888cfe118c19759bbc4b8fca2e004df , < c97426ec649d99596d8969e1a052c16b14b7b485 (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a3b935b6b6037eefb36bd27a60793a008358e8d",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "7b112bd43f1172fb152e848570a957467008a5ae",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "4ac7d92a4698e34e614c254359665b9de1f65283",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "291fe0bafee78c95f9f2e7f579f17793fd5a1e5a",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
},
{
"lessThan": "c97426ec649d99596d8969e1a052c16b14b7b485",
"status": "affected",
"version": "907eea486888cfe118c19759bbc4b8fca2e004df",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node(). With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:13.342Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a3b935b6b6037eefb36bd27a60793a008358e8d"
},
{
"url": "https://git.kernel.org/stable/c/7b112bd43f1172fb152e848570a957467008a5ae"
},
{
"url": "https://git.kernel.org/stable/c/4ac7d92a4698e34e614c254359665b9de1f65283"
},
{
"url": "https://git.kernel.org/stable/c/291fe0bafee78c95f9f2e7f579f17793fd5a1e5a"
},
{
"url": "https://git.kernel.org/stable/c/c97426ec649d99596d8969e1a052c16b14b7b485"
}
],
"title": "ipv6: do not warn on route notification size race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99070",
"datePublished": "2026-10-23T12:23:13.342Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:13.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99069 (GCVE-0-2026-99069)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
Input: ati_remote2 - fix type confusion in device attribute handlers
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: ati_remote2 - fix type confusion in device attribute handlers
Previously, the channel_mask and mode_mask attributes were registered on
the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b
("Input: ati-remote2 - use driver core to instantiate device
attributes") converted the driver to let the driver core manage them via
dev_groups in struct usb_driver, the attributes moved to the bound
usb_interface devices, but the show and store callbacks were not updated
accordingly.
As a result, the callbacks still invoked to_usb_device() on a device
pointer belonging to a struct usb_interface, producing an invalid
usb_device pointer.
Use to_usb_interface() directly in the attribute handlers to obtain the
interface and its driver data.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b20d6bf8014b2d6fcf65c150453d95a6276fd1fa , < e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89
(git)
Affected: b20d6bf8014b2d6fcf65c150453d95a6276fd1fa , < d738e51bf2c21921df351f536147178ae3cbd38b (git) Affected: b20d6bf8014b2d6fcf65c150453d95a6276fd1fa , < 2caae9d1977beea0a7914b3d86639262801fd116 (git) Affected: b20d6bf8014b2d6fcf65c150453d95a6276fd1fa , < f321cc430c49b6c1be0d53f2ef19d8342d8029cc (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/ati_remote2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89",
"status": "affected",
"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa",
"versionType": "git"
},
{
"lessThan": "d738e51bf2c21921df351f536147178ae3cbd38b",
"status": "affected",
"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa",
"versionType": "git"
},
{
"lessThan": "2caae9d1977beea0a7914b3d86639262801fd116",
"status": "affected",
"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa",
"versionType": "git"
},
{
"lessThan": "f321cc430c49b6c1be0d53f2ef19d8342d8029cc",
"status": "affected",
"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/ati_remote2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:12.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89"
},
{
"url": "https://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b"
},
{
"url": "https://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116"
},
{
"url": "https://git.kernel.org/stable/c/f321cc430c49b6c1be0d53f2ef19d8342d8029cc"
}
],
"title": "Input: ati_remote2 - fix type confusion in device attribute handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99069",
"datePublished": "2026-10-23T12:23:12.396Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:12.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99068 (GCVE-0-2026-99068)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions")
centralized the DAO input mapper clearing logic in
dao_clear_input(), but omitted the kfree() calls.
It removes the mapper entries from the list and sets their pointers
to NULL without freeing the allocated array. This leaks memory each
time dao_clear_input() is called.
Store the base pointer of the allocation before clearing the mapper
entries and free the array after removing entries from the list.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e576e7843c0d65b82d4092e5b386d9fbf5bc10c3 , < f7dc71c1ce885f5d9f128037ebc75d9c0356e060
(git)
Affected: e576e7843c0d65b82d4092e5b386d9fbf5bc10c3 , < 0919d8dd19f92e12829055c75fced9a454d644bf (git) Affected: e576e7843c0d65b82d4092e5b386d9fbf5bc10c3 , < 593d46fc6af9a0178a46e77d6d24b20d2314165f (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/ctxfi/ctdaio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7dc71c1ce885f5d9f128037ebc75d9c0356e060",
"status": "affected",
"version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3",
"versionType": "git"
},
{
"lessThan": "0919d8dd19f92e12829055c75fced9a454d644bf",
"status": "affected",
"version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3",
"versionType": "git"
},
{
"lessThan": "593d46fc6af9a0178a46e77d6d24b20d2314165f",
"status": "affected",
"version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/ctxfi/ctdaio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:11.461Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7dc71c1ce885f5d9f128037ebc75d9c0356e060"
},
{
"url": "https://git.kernel.org/stable/c/0919d8dd19f92e12829055c75fced9a454d644bf"
},
{
"url": "https://git.kernel.org/stable/c/593d46fc6af9a0178a46e77d6d24b20d2314165f"
}
],
"title": "ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99068",
"datePublished": "2026-10-23T12:23:11.461Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:11.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99067 (GCVE-0-2026-99067)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
When paths_from_inode() fails, scrub_print_warning_inode() jumps to err
without dropping the reference taken by btrfs_get_fs_root(), leaking a
reference to the root every time path resolution fails while printing
scrub warnings. Every other error and success path of the function
drops the reference.
Drop the reference on the paths_from_inode() failure path too.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
558540c17771eaf89b1a3be39aa2c8bc837da1a6 , < 41cabfbf3532e2a2a17be9e4876042a5393b5c8d
(git)
Affected: 558540c17771eaf89b1a3be39aa2c8bc837da1a6 , < 452a435b74f7f598a343c51f7c89c5d2244384b6 (git) Affected: 558540c17771eaf89b1a3be39aa2c8bc837da1a6 , < 12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549 (git) Affected: 558540c17771eaf89b1a3be39aa2c8bc837da1a6 , < a7e5992bc37088f9b00e531955022aef69de3dc7 (git) Affected: 558540c17771eaf89b1a3be39aa2c8bc837da1a6 , < 1fd742c7479961da6d0bb794ef8ac6b7b9442847 (git) |
|
| Linux | Linux |
Affected:
3.2
Unaffected: 0 , < 3.2 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/scrub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41cabfbf3532e2a2a17be9e4876042a5393b5c8d",
"status": "affected",
"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6",
"versionType": "git"
},
{
"lessThan": "452a435b74f7f598a343c51f7c89c5d2244384b6",
"status": "affected",
"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6",
"versionType": "git"
},
{
"lessThan": "12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549",
"status": "affected",
"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6",
"versionType": "git"
},
{
"lessThan": "a7e5992bc37088f9b00e531955022aef69de3dc7",
"status": "affected",
"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6",
"versionType": "git"
},
{
"lessThan": "1fd742c7479961da6d0bb794ef8ac6b7b9442847",
"status": "affected",
"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/scrub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings. Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:10.430Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d"
},
{
"url": "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6"
},
{
"url": "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"
},
{
"url": "https://git.kernel.org/stable/c/a7e5992bc37088f9b00e531955022aef69de3dc7"
},
{
"url": "https://git.kernel.org/stable/c/1fd742c7479961da6d0bb794ef8ac6b7b9442847"
}
],
"title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99067",
"datePublished": "2026-10-23T12:23:10.430Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:10.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99066 (GCVE-0-2026-99066)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
can: dev: init_can_skb(): restore skb header initialization
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: dev: init_can_skb(): restore skb header initialization
Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
removed the skb_reset_mac_header()/skb_reset_network_header()/
skb_reset_transport_header() calls from init_can_skb(). As a result, RX
skbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.
When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length
calculation overflows and triggers skb_under_panic -> kernel BUG -> full
machine panic.
The same issue was originally reported in 2014 on linux-can and fixed by
commit 969439016d2c ("can: add missing initialisations in CAN related
skbuffs"). packet_rcv_spkt() itself has never been hardened: only
packet_rcv() and tpacket_rcv() gained dev_has_header() checks in
commit d549699048b4 ("net/packet: fix packet receive on L3 devices
without visible hard header").
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9f10374bb024593a611e6845847f0444841a231b , < 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632
(git)
Affected: 9f10374bb024593a611e6845847f0444841a231b , < 0a04c0cb8606ff88399489d03ef255afe90d0d5f (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/dev/skb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632",
"status": "affected",
"version": "9f10374bb024593a611e6845847f0444841a231b",
"versionType": "git"
},
{
"lessThan": "0a04c0cb8606ff88399489d03ef255afe90d0d5f",
"status": "affected",
"version": "9f10374bb024593a611e6845847f0444841a231b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/dev/skb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: init_can_skb(): restore skb header initialization\n\nCommit 9f10374bb024 (\"can: remove private CAN skb headroom infrastructure\")\nremoved the skb_reset_mac_header()/skb_reset_network_header()/\nskb_reset_transport_header() calls from init_can_skb(). As a result, RX\nskbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.\nWhen such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length\ncalculation overflows and triggers skb_under_panic -\u003e kernel BUG -\u003e full\nmachine panic.\n\nThe same issue was originally reported in 2014 on linux-can and fixed by\ncommit 969439016d2c (\"can: add missing initialisations in CAN related\nskbuffs\"). packet_rcv_spkt() itself has never been hardened: only\npacket_rcv() and tpacket_rcv() gained dev_has_header() checks in\ncommit d549699048b4 (\"net/packet: fix packet receive on L3 devices\nwithout visible hard header\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:09.516Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632"
},
{
"url": "https://git.kernel.org/stable/c/0a04c0cb8606ff88399489d03ef255afe90d0d5f"
}
],
"title": "can: dev: init_can_skb(): restore skb header initialization",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99066",
"datePublished": "2026-10-23T12:23:09.516Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:09.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99065 (GCVE-0-2026-99065)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing
synchronous"), the cpuset hotplug operation becomes synchronous. That
commit also removes the code that handles race between cpuset_hotplug_work
and cpu hotplug notifier with the assumption that race is now gone.
Later commit 7a0aabd9ce69 ("cgroup/cpuset: Always use cpu_active_mask")
updates the cpuset code to always use cpu_active_mask instead of
cpu_online_mask in some places including guarantee_online_cpus() which
is renamed to guarantee_active_cpus() in that commit.
In the case of CPU offline operation, cpu_active_mask is updated
first in sched_cpu_deactivate() to remove the offline CPU before
cpuset_handle_hotplug() is called to update the effective_cpus of the
affected cpusets. The cpu_online_mask is updated after that near the end
of the offline operation to remove the offline CPU. As a result, the race
comes back and the top cpuset may not have any active CPU leading to NULL
pointer dereference during the race window when guarantee_active_cpus()
is called after cpu_active_mask is updated to remove the CPU to be torn
down but before cpuset_handle_hotplug() is able to properly update the
effective_cpus of the top cpuset.
Fix this by adding back the NULL cs check to avoid this problem.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7a0aabd9ce697fc581ec691b21f748050fbcf004 , < 8d88d3221204fbb1b6dc2c0f2f2181fe49126639
(git)
Affected: 7a0aabd9ce697fc581ec691b21f748050fbcf004 , < a21c255159bfe0034740292e10d2e258feeeb10d (git) Affected: 7a0aabd9ce697fc581ec691b21f748050fbcf004 , < 23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cpuset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d88d3221204fbb1b6dc2c0f2f2181fe49126639",
"status": "affected",
"version": "7a0aabd9ce697fc581ec691b21f748050fbcf004",
"versionType": "git"
},
{
"lessThan": "a21c255159bfe0034740292e10d2e258feeeb10d",
"status": "affected",
"version": "7a0aabd9ce697fc581ec691b21f748050fbcf004",
"versionType": "git"
},
{
"lessThan": "23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2",
"status": "affected",
"version": "7a0aabd9ce697fc581ec691b21f748050fbcf004",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cpuset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()\n\nWith commit 2125c0034c5d (\"cgroup/cpuset: Make cpuset hotplug processing\nsynchronous\"), the cpuset hotplug operation becomes synchronous. That\ncommit also removes the code that handles race between cpuset_hotplug_work\nand cpu hotplug notifier with the assumption that race is now gone.\nLater commit 7a0aabd9ce69 (\"cgroup/cpuset: Always use cpu_active_mask\")\nupdates the cpuset code to always use cpu_active_mask instead of\ncpu_online_mask in some places including guarantee_online_cpus() which\nis renamed to guarantee_active_cpus() in that commit.\n\nIn the case of CPU offline operation, cpu_active_mask is updated\nfirst in sched_cpu_deactivate() to remove the offline CPU before\ncpuset_handle_hotplug() is called to update the effective_cpus of the\naffected cpusets. The cpu_online_mask is updated after that near the end\nof the offline operation to remove the offline CPU. As a result, the race\ncomes back and the top cpuset may not have any active CPU leading to NULL\npointer dereference during the race window when guarantee_active_cpus()\nis called after cpu_active_mask is updated to remove the CPU to be torn\ndown but before cpuset_handle_hotplug() is able to properly update the\neffective_cpus of the top cpuset.\n\nFix this by adding back the NULL cs check to avoid this problem."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:08.458Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d88d3221204fbb1b6dc2c0f2f2181fe49126639"
},
{
"url": "https://git.kernel.org/stable/c/a21c255159bfe0034740292e10d2e258feeeb10d"
},
{
"url": "https://git.kernel.org/stable/c/23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2"
}
],
"title": "cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99065",
"datePublished": "2026-10-23T12:23:08.458Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:08.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99064 (GCVE-0-2026-99064)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
cipso: adjust cached option offsets when removing CIPSO
Summary
In the Linux kernel, the following vulnerability has been resolved:
cipso: adjust cached option offsets when removing CIPSO
cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.
For example, with a valid 10-byte CIPSO option followed by a seven-byte
RR option, parsing records rr at offset 30. Removing CIPSO moves RR to
offset 20, while the cached offset remains 30. Consumers such as
ip_forward_options() and __ip_options_echo() then access the wrong bytes;
the latter may interpret packet data as the option length and copy it into
fixed-size option storage.
Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and
router_alert offsets when they follow CIPSO. cipso_len is the distance
the first memmove() shifts those options. The later header move and
network-header reset relocate the bytes and their offset base together.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
89aa3619d141d6cfb6040a561aebb6d99d3e2285 , < b965977126a90e01825814c859ba4788691eddd3
(git)
Affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 , < 2200fe1d6148b78e1b8f00f4b2bd47760015077f (git) Affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 , < 6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0 (git) Affected: 89aa3619d141d6cfb6040a561aebb6d99d3e2285 , < 6d25ffca055a77787c21a36b66c253f76239411b (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/cipso_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b965977126a90e01825814c859ba4788691eddd3",
"status": "affected",
"version": "89aa3619d141d6cfb6040a561aebb6d99d3e2285",
"versionType": "git"
},
{
"lessThan": "2200fe1d6148b78e1b8f00f4b2bd47760015077f",
"status": "affected",
"version": "89aa3619d141d6cfb6040a561aebb6d99d3e2285",
"versionType": "git"
},
{
"lessThan": "6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0",
"status": "affected",
"version": "89aa3619d141d6cfb6040a561aebb6d99d3e2285",
"versionType": "git"
},
{
"lessThan": "6d25ffca055a77787c21a36b66c253f76239411b",
"status": "affected",
"version": "89aa3619d141d6cfb6040a561aebb6d99d3e2285",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/cipso_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30. Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30. Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO. cipso_len is the distance\nthe first memmove() shifts those options. The later header move and\nnetwork-header reset relocate the bytes and their offset base together."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:05.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b965977126a90e01825814c859ba4788691eddd3"
},
{
"url": "https://git.kernel.org/stable/c/2200fe1d6148b78e1b8f00f4b2bd47760015077f"
},
{
"url": "https://git.kernel.org/stable/c/6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0"
},
{
"url": "https://git.kernel.org/stable/c/6d25ffca055a77787c21a36b66c253f76239411b"
}
],
"title": "cipso: adjust cached option offsets when removing CIPSO",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99064",
"datePublished": "2026-10-23T12:23:05.854Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-23T12:23:05.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99063 (GCVE-0-2026-99063)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
dm ioctl: don't let data_start run past the buffer
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm ioctl: don't let data_start run past the buffer
struct dm_ioctl has seven bytes of trailing padding, so the smallest
buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),
is seven bytes shorter than sizeof(struct dm_ioctl).
get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without
looking at how big the buffer actually is. Ask for the minimum and
data_start ends up seven bytes past the end. Callers add it to
data_size, and ctl_ioctl() copies that much back to userspace:
BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0
Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140
ctl_ioctl+0x5e3/0xcb0
dm_ctl_ioctl+0x25/0x40
allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)
A DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the
seven bytes that leak are whatever sat next to the allocation.
Clamp data_start to the buffer size.
Note that this is not a security bug because the out-of-bounds read can
only be triggered by root.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
76c072b48e39e9291fbf02d6c912cf27d65e093d , < 98195e822343a656b92e235847ab3e72b1a3f920
(git)
Affected: 76c072b48e39e9291fbf02d6c912cf27d65e093d , < e5c3f3d8935ecc64c962fb66e6a86dbf79218f61 (git) Affected: 76c072b48e39e9291fbf02d6c912cf27d65e093d , < 5680b6fb3054677d4ee65d3baba24b649f1b430e (git) Affected: 76c072b48e39e9291fbf02d6c912cf27d65e093d , < 725b49c689bbb29ef740b0d6b5ea9390baa9a695 (git) Affected: 76c072b48e39e9291fbf02d6c912cf27d65e093d , < 9b3fcf519d370df94a56f3b272d9eddffffa5be8 (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98195e822343a656b92e235847ab3e72b1a3f920",
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"versionType": "git"
},
{
"lessThan": "e5c3f3d8935ecc64c962fb66e6a86dbf79218f61",
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"versionType": "git"
},
{
"lessThan": "5680b6fb3054677d4ee65d3baba24b649f1b430e",
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"versionType": "git"
},
{
"lessThan": "725b49c689bbb29ef740b0d6b5ea9390baa9a695",
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"versionType": "git"
},
{
"lessThan": "9b3fcf519d370df94a56f3b272d9eddffffa5be8",
"status": "affected",
"version": "76c072b48e39e9291fbf02d6c912cf27d65e093d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: don\u0027t let data_start run past the buffer\n\nstruct dm_ioctl has seven bytes of trailing padding, so the smallest\nbuffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data),\nis seven bytes shorter than sizeof(struct dm_ioctl).\n\nget_result_buffer() sets data_start to sizeof(struct dm_ioctl) without\nlooking at how big the buffer actually is. Ask for the minimum and\ndata_start ends up seven bytes past the end. Callers add it to\ndata_size, and ctl_ioctl() copies that much back to userspace:\n\n BUG: KASAN: slab-out-of-bounds in _copy_to_user+0xad/0xd0\n Read of size 312 at addr ffff8880169e4c00 by task repro-dm/140\n ctl_ioctl+0x5e3/0xcb0\n dm_ctl_ioctl+0x25/0x40\n allocated 305-byte region [ffff8880169e4c00, ffff8880169e4d31)\n\nA DM_LIST_DEVICES with data_size set to 305 is enough to hit it, and the\nseven bytes that leak are whatever sat next to the allocation.\n\nClamp data_start to the buffer size.\n\nNote that this is not a security bug because the out-of-bounds read can\nonly be triggered by root."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:04.655Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98195e822343a656b92e235847ab3e72b1a3f920"
},
{
"url": "https://git.kernel.org/stable/c/e5c3f3d8935ecc64c962fb66e6a86dbf79218f61"
},
{
"url": "https://git.kernel.org/stable/c/5680b6fb3054677d4ee65d3baba24b649f1b430e"
},
{
"url": "https://git.kernel.org/stable/c/725b49c689bbb29ef740b0d6b5ea9390baa9a695"
},
{
"url": "https://git.kernel.org/stable/c/9b3fcf519d370df94a56f3b272d9eddffffa5be8"
}
],
"title": "dm ioctl: don\u0027t let data_start run past the buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99063",
"datePublished": "2026-10-23T12:23:04.655Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-23T12:23:04.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99062 (GCVE-0-2026-99062)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-10-23 12:23
VLAI
EPSS
VEX
Title
vsock/virtio: account only unread bytes in read_skb()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: account only unread bytes in read_skb()
After a partial stream receive, rx_bytes tracks the unread suffix while
buf_used and peer credit still cover the whole packet.
virtio_transport_read_skb() dequeues that packet but passes pkt_len for
both counters, underflowing rx_bytes.
On a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read
from a 100-byte packet made SIOCINQ report -40, an empty recv return
ELOOP, and poll report the empty socket readable. After verdict detach,
receiving 40 bytes wrapped the counter to zero and hid those queued bytes
until one more byte arrived. The fixed run kept the counter balanced
and exposed all queued data immediately.
This was found during an LLM-assisted manual source audit of VSOCK
receive accounting while re-evaluating virtio_transport_read_skb() after
CVE-2024-50169.
Subtract only skb->len minus the VSOCK offset from rx_bytes. Retain the
full packet length for buf_used and peer credit.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7893a41deaf28b53036d4ea7cd9f7d54e8874dfc , < e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b
(git)
Affected: 45ca7e9f0730ae36fc610e675b990e9cc9ca0714 , < 38bad3930b1185dd6c98db3dd342ddc123c6f3ef (git) Affected: 45ca7e9f0730ae36fc610e675b990e9cc9ca0714 , < dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc (git) Affected: 45ca7e9f0730ae36fc610e675b990e9cc9ca0714 , < a463f55c791b96cfd12df8b10ea737d45c80bb18 (git) Affected: 17bada47e9ac3621c28e0ffa89af8279fedea00a (git) Affected: 6.12.34 , < 6.12.113 (semver) Affected: 6.15.3 , < 6.16 (semver) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b",
"status": "affected",
"version": "7893a41deaf28b53036d4ea7cd9f7d54e8874dfc",
"versionType": "git"
},
{
"lessThan": "38bad3930b1185dd6c98db3dd342ddc123c6f3ef",
"status": "affected",
"version": "45ca7e9f0730ae36fc610e675b990e9cc9ca0714",
"versionType": "git"
},
{
"lessThan": "dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc",
"status": "affected",
"version": "45ca7e9f0730ae36fc610e675b990e9cc9ca0714",
"versionType": "git"
},
{
"lessThan": "a463f55c791b96cfd12df8b10ea737d45c80bb18",
"status": "affected",
"version": "45ca7e9f0730ae36fc610e675b990e9cc9ca0714",
"versionType": "git"
},
{
"status": "affected",
"version": "17bada47e9ac3621c28e0ffa89af8279fedea00a",
"versionType": "git"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "6.12.34",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: account only unread bytes in read_skb()\n\nAfter a partial stream receive, rx_bytes tracks the unread suffix while\nbuf_used and peer credit still cover the whole packet.\nvirtio_transport_read_skb() dequeues that packet but passes pkt_len for\nboth counters, underflowing rx_bytes.\n\nOn a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read\nfrom a 100-byte packet made SIOCINQ report -40, an empty recv return\nELOOP, and poll report the empty socket readable. After verdict detach,\nreceiving 40 bytes wrapped the counter to zero and hid those queued bytes\nuntil one more byte arrived. The fixed run kept the counter balanced\nand exposed all queued data immediately.\n\nThis was found during an LLM-assisted manual source audit of VSOCK\nreceive accounting while re-evaluating virtio_transport_read_skb() after\nCVE-2024-50169.\n\nSubtract only skb-\u003elen minus the VSOCK offset from rx_bytes. Retain the\nfull packet length for buf_used and peer credit."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:23:03.360Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b"
},
{
"url": "https://git.kernel.org/stable/c/38bad3930b1185dd6c98db3dd342ddc123c6f3ef"
},
{
"url": "https://git.kernel.org/stable/c/dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc"
},
{
"url": "https://git.kernel.org/stable/c/a463f55c791b96cfd12df8b10ea737d45c80bb18"
}
],
"title": "vsock/virtio: account only unread bytes in read_skb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99062",
"datePublished": "2026-10-23T12:23:03.360Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-23T12:23:03.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99061 (GCVE-0-2026-99061)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:22 – Updated: 2026-10-23 12:22
VLAI
EPSS
VEX
Title
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
When the driver is removed while the user space process that created
the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device
interface is removed twice and the kernel crashes.
The two paths are:
- wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P
device. nl80211_del_interface() holds RTNL and the wiphy mutex and
calls brcmf_p2p_del_vif(), which disables discovery and waits up to
1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),
which unregisters the wdev and frees the vif and the ifp.
- brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,
and calls brcmf_remove_interface(ifp, false) for the same ifp.
brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on
rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls
cfg80211_unregister_wdev() on the wdev that was already unregistered
and freed.
The second list_del_rcu() of wdev->list faults on LIST_POISON2:
brcmfmac: brcmf_p2p_del_vif delete P2P vif
brcmfmac: brcmf_p2p_deinit_discovery enter
brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared
brcmfmac: brcmf_detach Enter
brcmfmac: brcmf_bus_change_state 1 -> 0
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
[1.5 s later, brcmf_p2p_del_vif() timed out]
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
Unable to handle kernel paging request at virtual address dead000000000122
Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP
pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]
Call trace:
_cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]
cfg80211_unregister_wdev+0x10/0x1c [cfg80211]
brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]
brcmf_remove_interface+0x1f4/0x254 [brcmfmac]
brcmf_detach+0x88/0x180 [brcmfmac]
brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]
brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]
brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]
sdio_bus_remove+0x38/0x144
device_release_driver_internal+0x1e8/0x2c0
device_release_driver+0x14/0x20
brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]
brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]
__exit_compat+0x18/0x418 [brcmfmac_cyw]
__arm64_sys_delete_module+0x1ac/0x244
The log was taken with debug=0x406 on an i.MX 8M Plus board with a
CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of
brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same
in mainline.
To reproduce:
1. Start wpa_supplicant on wlan0 and let it associate. It creates the
P2P device (iw dev shows "type P2P-device").
2. Stop wpa_supplicant and remove the driver without waiting for
wpa_supplicant to exit:
kill $(pidof wpa_supplicant)
rmmod brcmfmac_cyw brcmfmac
The crash is reproducible on that board.
For the interface without a netdev (the P2P device), take RTNL and the
wiphy mutex in brcmf_detach() before reading iflist, and remove it with
locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the
slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev
any more. The interfaces with a netdev are removed as before, because
brcmf_del_if() takes RTNL on its own for the primary interface.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9831bcb987df4aff6a1d85975f1dda4c654f298d , < 7b79131e357c4786765b20a994ad40d4d35f2163
(git)
Affected: 9831bcb987df4aff6a1d85975f1dda4c654f298d , < 2e0c8c60a11b3177e7432c71d41249e276a0825f (git) Affected: 9831bcb987df4aff6a1d85975f1dda4c654f298d , < eef16a74ff8ed2a838d6bb862bb2c7783fce7466 (git) Affected: 9831bcb987df4aff6a1d85975f1dda4c654f298d , < 47ca6395a1d91545cc9403f9218bc61be941a0c3 (git) Affected: 9831bcb987df4aff6a1d85975f1dda4c654f298d , < 08a3f02fea636e97a7422d1512f76dacdb5b0887 (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b79131e357c4786765b20a994ad40d4d35f2163",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "2e0c8c60a11b3177e7432c71d41249e276a0825f",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "eef16a74ff8ed2a838d6bb862bb2c7783fce7466",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "47ca6395a1d91545cc9403f9218bc61be941a0c3",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "08a3f02fea636e97a7422d1512f76dacdb5b0887",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n and calls brcmf_remove_interface(ifp, false) for the same ifp.\n brcmf_p2p_ifp_removed() reads ifp-\u003evif and then blocks on\n rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n cfg80211_unregister_wdev() on the wdev that was already unregistered\n and freed.\n\nThe second list_del_rcu() of wdev-\u003elist faults on LIST_POISON2:\n\n brcmfmac: brcmf_p2p_del_vif delete P2P vif\n brcmfmac: brcmf_p2p_deinit_discovery enter\n brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n brcmfmac: brcmf_detach Enter\n brcmfmac: brcmf_bus_change_state 1 -\u003e 0\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n [1.5 s later, brcmf_p2p_del_vif() timed out]\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n Unable to handle kernel paging request at virtual address dead000000000122\n Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n Call trace:\n _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n brcmf_detach+0x88/0x180 [brcmfmac]\n brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n sdio_bus_remove+0x38/0x144\n device_release_driver_internal+0x1e8/0x2c0\n device_release_driver+0x14/0x20\n brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n __exit_compat+0x18/0x418 [brcmfmac_cyw]\n __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug=0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n 1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n P2P device (iw dev shows \"type P2P-device\").\n 2. Stop wpa_supplicant and remove the driver without waiting for\n wpa_supplicant to exit:\n\n kill $(pidof wpa_supplicant)\n rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:22:59.770Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163"
},
{
"url": "https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f"
},
{
"url": "https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466"
},
{
"url": "https://git.kernel.org/stable/c/47ca6395a1d91545cc9403f9218bc61be941a0c3"
},
{
"url": "https://git.kernel.org/stable/c/08a3f02fea636e97a7422d1512f76dacdb5b0887"
}
],
"title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99061",
"datePublished": "2026-10-23T12:22:59.770Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-23T12:22:59.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99060 (GCVE-0-2026-99060)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:22 – Updated: 2026-10-23 12:22
VLAI
EPSS
VEX
Title
wifi: mt76: mt7603: initialize global station WCID
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7603: initialize global station WCID
mt7603 uses a driver-private global station WCID for frames that have
neither a station nor a vif, including frames injected through a monitor
interface. Unlike the core global WCID initialized by
mt76_register_device(), this WCID is published without ever being passed
to mt76_wcid_init().
Since commit 0335c034e726 ("wifi: mt76: fix race condition related to
checking tx queue fill status"), mt76_tx() queues every such frame on the
WCID's tx_pending or tx_offchannel queue and links its tx_list. The first
injected frame therefore reaches __skb_queue_tail() with an uninitialized
sk_buff_head and dereferences a NULL prev pointer.
Initialize the WCID before publishing it.
The fix was tested on an MT7603 PCIe device. Three wildcard probe requests
were injected through a monitor interface. The hardware queue head and tail
advanced from 0 to 3 and a second radio captured the third request over the
air. No oops or reset occurred. After restoring AP mode, a 150 MB transfer
also completed without a reset.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d2defcddfe90b3be0cfccc2482495ab1fb759586 , < 99b8bd6323e6fc69615af828522878b7acb77bff
(git)
Affected: 0335c034e7265d36d956e806f33202c94a8a9860 , < e454ec553996f21085657c96c8a605e2d89a81a6 (git) Affected: 0335c034e7265d36d956e806f33202c94a8a9860 , < dd117d17e8aa2e89f857fb708e5b770709fb81cb (git) Affected: 0335c034e7265d36d956e806f33202c94a8a9860 , < 19d6fa087dcf242223645828b8282d4040bad168 (git) Affected: 0335c034e7265d36d956e806f33202c94a8a9860 , < 456de496b53ae73e6e3020fec815dbdc88aa7c07 (git) Affected: 6.6.48 , < 6.6.160 (semver) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7603/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "99b8bd6323e6fc69615af828522878b7acb77bff",
"status": "affected",
"version": "d2defcddfe90b3be0cfccc2482495ab1fb759586",
"versionType": "git"
},
{
"lessThan": "e454ec553996f21085657c96c8a605e2d89a81a6",
"status": "affected",
"version": "0335c034e7265d36d956e806f33202c94a8a9860",
"versionType": "git"
},
{
"lessThan": "dd117d17e8aa2e89f857fb708e5b770709fb81cb",
"status": "affected",
"version": "0335c034e7265d36d956e806f33202c94a8a9860",
"versionType": "git"
},
{
"lessThan": "19d6fa087dcf242223645828b8282d4040bad168",
"status": "affected",
"version": "0335c034e7265d36d956e806f33202c94a8a9860",
"versionType": "git"
},
{
"lessThan": "456de496b53ae73e6e3020fec815dbdc88aa7c07",
"status": "affected",
"version": "0335c034e7265d36d956e806f33202c94a8a9860",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.48",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7603/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7603: initialize global station WCID\n\nmt7603 uses a driver-private global station WCID for frames that have\nneither a station nor a vif, including frames injected through a monitor\ninterface. Unlike the core global WCID initialized by\nmt76_register_device(), this WCID is published without ever being passed\nto mt76_wcid_init().\n\nSince commit 0335c034e726 (\"wifi: mt76: fix race condition related to\nchecking tx queue fill status\"), mt76_tx() queues every such frame on the\nWCID\u0027s tx_pending or tx_offchannel queue and links its tx_list. The first\ninjected frame therefore reaches __skb_queue_tail() with an uninitialized\nsk_buff_head and dereferences a NULL prev pointer.\n\nInitialize the WCID before publishing it.\n\nThe fix was tested on an MT7603 PCIe device. Three wildcard probe requests\nwere injected through a monitor interface. The hardware queue head and tail\nadvanced from 0 to 3 and a second radio captured the third request over the\nair. No oops or reset occurred. After restoring AP mode, a 150 MB transfer\nalso completed without a reset."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:22:49.164Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/99b8bd6323e6fc69615af828522878b7acb77bff"
},
{
"url": "https://git.kernel.org/stable/c/e454ec553996f21085657c96c8a605e2d89a81a6"
},
{
"url": "https://git.kernel.org/stable/c/dd117d17e8aa2e89f857fb708e5b770709fb81cb"
},
{
"url": "https://git.kernel.org/stable/c/19d6fa087dcf242223645828b8282d4040bad168"
},
{
"url": "https://git.kernel.org/stable/c/456de496b53ae73e6e3020fec815dbdc88aa7c07"
}
],
"title": "wifi: mt76: mt7603: initialize global station WCID",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99060",
"datePublished": "2026-10-23T12:22:49.164Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-23T12:22:49.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99059 (GCVE-0-2026-99059)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:22 – Updated: 2026-10-23 12:22
VLAI
EPSS
VEX
Title
wireguard: noise: reject response consumption after intermediate initiation
Summary
In the Linux kernel, the following vulnerability has been resolved:
wireguard: noise: reject response consumption after intermediate initiation
Two threads begin processing the identical response message, received
twice. The first thread, A, runs. While it's running, the second one,
B, gets partway through, and during that slow calculation, or even while
blocking on down_write(), A completes and then also a handshake
initiation that's already been queued up runs in thread C, which itself
takes that same down_write(). The handshake initiation creation
succeeds, and sets the state back to waiting-for-response, and calls
up_write(), at which point thread B resumes, because either its finished
its calculations or was finally allowed to acquire down_write(). Thread
B then copies the state back to the peer, and begins a new session,
using that state, which is the same session as the one made in thread A.
Thread A Thread B Thread C
down_read()
sA = handshake->state
memcpy(cA, handshake->crypto)
up_read()
if (sA != 1)
goto fail
slow_crypto(cA)
down_read()
sB = handshake->state
memcpy(cB, handshake->crypto)
up_read()
if (sB != 1)
goto fail
slow_crypto(cB)
down_write()
if (sA != handshake->state)
goto fail
memcpy(handshake->crypto, cA)
handshake->state = 2
up_write()
down_write()
if (handshake->state != 2)
goto fail
derive_session(handshake->crypto)
up_write()
down_write()
slow_crypto(handshake->crypto)
handshake->state = 1
up_write()
down_write()
if (sB != handshake->state)
goto fail
memcpy(handshake->crypto, cB)
handshake->state = 2
up_write()
down_write()
if (handshake->state != 2)
goto fail
derive_session(handshake->crypto)
up_write()
This seems basically impossible to hit in a meaningful way in practice,
but ensure that it absolutely cannot happen by comparing the ephemeral
private key that's on the stack with the latest one that the peer's
handshake state has.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e7096c131e5161fa3b8e52a650d7719d2857adfd , < fb5ce4c7790c3eeec820302d08d70ecf46af4295
(git)
Affected: e7096c131e5161fa3b8e52a650d7719d2857adfd , < c76a80db593096edf2b3b3972f58b6342a8c6c04 (git) Affected: e7096c131e5161fa3b8e52a650d7719d2857adfd , < 4d64a3d6e96aa78619c9c29ffde309794974588a (git) Affected: e7096c131e5161fa3b8e52a650d7719d2857adfd , < 3bec3d32c2a3afd164fc87f95457df2cf9049c20 (git) Affected: e7096c131e5161fa3b8e52a650d7719d2857adfd , < d0305f8d90029556260c6824b61c493c424eba9e (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireguard/noise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb5ce4c7790c3eeec820302d08d70ecf46af4295",
"status": "affected",
"version": "e7096c131e5161fa3b8e52a650d7719d2857adfd",
"versionType": "git"
},
{
"lessThan": "c76a80db593096edf2b3b3972f58b6342a8c6c04",
"status": "affected",
"version": "e7096c131e5161fa3b8e52a650d7719d2857adfd",
"versionType": "git"
},
{
"lessThan": "4d64a3d6e96aa78619c9c29ffde309794974588a",
"status": "affected",
"version": "e7096c131e5161fa3b8e52a650d7719d2857adfd",
"versionType": "git"
},
{
"lessThan": "3bec3d32c2a3afd164fc87f95457df2cf9049c20",
"status": "affected",
"version": "e7096c131e5161fa3b8e52a650d7719d2857adfd",
"versionType": "git"
},
{
"lessThan": "d0305f8d90029556260c6824b61c493c424eba9e",
"status": "affected",
"version": "e7096c131e5161fa3b8e52a650d7719d2857adfd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireguard/noise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it\u0027s running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that\u0027s already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA = handshake-\u003estate\n memcpy(cA, handshake-\u003ecrypto)\nup_read()\nif (sA != 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB = handshake-\u003estate\n\t\t\t\t memcpy(cB, handshake-\u003ecrypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB != 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA != handshake-\u003estate)\n goto fail\n memcpy(handshake-\u003ecrypto, cA)\n handshake-\u003estate = 2\nup_write()\ndown_write()\n if (handshake-\u003estate != 2)\n goto fail\n derive_session(handshake-\u003ecrypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake-\u003ecrypto)\n\t\t\t\t\t\t\t\t handshake-\u003estate = 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB != handshake-\u003estate)\n\t\t\t\t goto fail\n\t\t\t\t memcpy(handshake-\u003ecrypto, cB)\n\t\t\t\t handshake-\u003estate = 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake-\u003estate != 2)\n\t\t\t\t goto fail\n\t\t\t\t derive_session(handshake-\u003ecrypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that\u0027s on the stack with the latest one that the peer\u0027s\nhandshake state has."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:22:47.559Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb5ce4c7790c3eeec820302d08d70ecf46af4295"
},
{
"url": "https://git.kernel.org/stable/c/c76a80db593096edf2b3b3972f58b6342a8c6c04"
},
{
"url": "https://git.kernel.org/stable/c/4d64a3d6e96aa78619c9c29ffde309794974588a"
},
{
"url": "https://git.kernel.org/stable/c/3bec3d32c2a3afd164fc87f95457df2cf9049c20"
},
{
"url": "https://git.kernel.org/stable/c/d0305f8d90029556260c6824b61c493c424eba9e"
}
],
"title": "wireguard: noise: reject response consumption after intermediate initiation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99059",
"datePublished": "2026-10-23T12:22:47.559Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-23T12:22:47.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99058 (GCVE-0-2026-99058)
Vulnerability from cvelistv5 – Published: 2026-10-23 12:22 – Updated: 2026-10-23 12:22
VLAI
EPSS
VEX
Title
workqueue: Fix NULL current_pwq deref in chained work check
Summary
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix NULL current_pwq deref in chained work check
current_wq_worker() only tells us that %current is a kworker. It does
not guarantee that the worker is currently executing a work item, as
worker->current_pwq is populated only while process_one_work() is running
the work function.
is_chained_work() can be reached while queueing on a draining or
destroying workqueue. If a kworker outside work-item execution reaches
that path, current_wq_worker() returns a worker but worker->current_pwq is
NULL, and the chained-work test can fault before it emits the intended
warning.
Guard the chained-work test with worker->current_pwq. A kworker without
current_pwq is not executing work on the target workqueue, so the helper
should return false and let the draining/destroying warning fire.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8d03ecfe471802d6afe97da97722b6924533aa82 , < 3dc61af2998cfc7312d6e59bbdcd5eed074483f2
(git)
Affected: 8d03ecfe471802d6afe97da97722b6924533aa82 , < 729d576df89c7e4341e58c452f8890620a610ac2 (git) Affected: 8d03ecfe471802d6afe97da97722b6924533aa82 , < b12a25fb2b9d5dac80e419d695450cc17a51fdfd (git) Affected: 8d03ecfe471802d6afe97da97722b6924533aa82 , < 1a2668682e998039a027796b236319b380078a6a (git) Affected: 8d03ecfe471802d6afe97da97722b6924533aa82 , < 980db94e3eeefdd8a1c46f86412c33a7f7806f51 (git) |
|
| Linux | Linux |
Affected:
3.9
Unaffected: 0 , < 3.9 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/workqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3dc61af2998cfc7312d6e59bbdcd5eed074483f2",
"status": "affected",
"version": "8d03ecfe471802d6afe97da97722b6924533aa82",
"versionType": "git"
},
{
"lessThan": "729d576df89c7e4341e58c452f8890620a610ac2",
"status": "affected",
"version": "8d03ecfe471802d6afe97da97722b6924533aa82",
"versionType": "git"
},
{
"lessThan": "b12a25fb2b9d5dac80e419d695450cc17a51fdfd",
"status": "affected",
"version": "8d03ecfe471802d6afe97da97722b6924533aa82",
"versionType": "git"
},
{
"lessThan": "1a2668682e998039a027796b236319b380078a6a",
"status": "affected",
"version": "8d03ecfe471802d6afe97da97722b6924533aa82",
"versionType": "git"
},
{
"lessThan": "980db94e3eeefdd8a1c46f86412c33a7f7806f51",
"status": "affected",
"version": "8d03ecfe471802d6afe97da97722b6924533aa82",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/workqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker-\u003ecurrent_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker-\u003ecurrent_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarning.\n\nGuard the chained-work test with worker-\u003ecurrent_pwq. A kworker without\ncurrent_pwq is not executing work on the target workqueue, so the helper\nshould return false and let the draining/destroying warning fire."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:22:45.920Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3dc61af2998cfc7312d6e59bbdcd5eed074483f2"
},
{
"url": "https://git.kernel.org/stable/c/729d576df89c7e4341e58c452f8890620a610ac2"
},
{
"url": "https://git.kernel.org/stable/c/b12a25fb2b9d5dac80e419d695450cc17a51fdfd"
},
{
"url": "https://git.kernel.org/stable/c/1a2668682e998039a027796b236319b380078a6a"
},
{
"url": "https://git.kernel.org/stable/c/980db94e3eeefdd8a1c46f86412c33a7f7806f51"
}
],
"title": "workqueue: Fix NULL current_pwq deref in chained work check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99058",
"datePublished": "2026-10-23T12:22:45.920Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-23T12:22:45.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}