Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
34954 vulnerabilities found for linux by linux
CVE-2026-98164 (GCVE-0-2026-98164)
Vulnerability from nvd – Published: 2026-09-29 12:02 – Updated: 2026-09-29 12:02
VLAI
EPSS
VEX
Title
KVM: x86/mmu: Check write tracking in all address spaces
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() checks only the supplied memslot, but page
tracking is per-address-space and shadow pages are shared across all
address spaces. With SMM, a GFN can therefore be write-tracked in one
address space and appear untracked through the other.
Check the supplied slot first, then the slot for the other address space.
This ensures all callers honor write tracking regardless of the active
address space. In particular, it prevents mmu_try_to_unsync_pages() from
marking an upper-level shadow page unsync and eventually triggering the
BUG in pte_list_remove().
[invert direction of the conditional. - Paolo]
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < 09aa68552d2542cc6c23edd1568ac265dc5d886f
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 429b6f43b4d8c98988fdca99e02dc156134e3d77 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < c0a9bd5fca0b5f2dea32b0fc31350e71e8648112 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < ec8fcaf354c1cbb36755d48e9f5a00c9591349e5 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 0f38453cdb2e17566ccb7c0f3dabd5bd21caca26 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09aa68552d2542cc6c23edd1568ac265dc5d886f",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "429b6f43b4d8c98988fdca99e02dc156134e3d77",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "c0a9bd5fca0b5f2dea32b0fc31350e71e8648112",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "ec8fcaf354c1cbb36755d48e9f5a00c9591349e5",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "0f38453cdb2e17566ccb7c0f3dabd5bd21caca26",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Check write tracking in all address spaces\n\nkvm_gfn_is_write_tracked() checks only the supplied memslot, but page\ntracking is per-address-space and shadow pages are shared across all\naddress spaces. With SMM, a GFN can therefore be write-tracked in one\naddress space and appear untracked through the other.\n\nCheck the supplied slot first, then the slot for the other address space.\nThis ensures all callers honor write tracking regardless of the active\naddress space. In particular, it prevents mmu_try_to_unsync_pages() from\nmarking an upper-level shadow page unsync and eventually triggering the\nBUG in pte_list_remove().\n\n[invert direction of the conditional. - Paolo]"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T12:02:12.574Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09aa68552d2542cc6c23edd1568ac265dc5d886f"
},
{
"url": "https://git.kernel.org/stable/c/429b6f43b4d8c98988fdca99e02dc156134e3d77"
},
{
"url": "https://git.kernel.org/stable/c/d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a"
},
{
"url": "https://git.kernel.org/stable/c/c0a9bd5fca0b5f2dea32b0fc31350e71e8648112"
},
{
"url": "https://git.kernel.org/stable/c/ec8fcaf354c1cbb36755d48e9f5a00c9591349e5"
},
{
"url": "https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"
}
],
"title": "KVM: x86/mmu: Check write tracking in all address spaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98164",
"datePublished": "2026-09-29T12:02:12.574Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-29T12:02:12.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98163 (GCVE-0-2026-98163)
Vulnerability from nvd – Published: 2026-09-26 08:31 – Updated: 2026-09-26 08:31
VLAI
EPSS
VEX
Title
cgroup: Avoid iteration of dying tasks with zero refcount
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avoid iteration of dying tasks with zero refcount
The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is
possible before cgroup_task_release()/put_task_struct_rcu_user()).
The tasks after cgroup_task_release() and before cgroup_task_free()
are subject to race when they may or may not have ->usage count > 0.
The race window is between css_task_iter_next() invocations
when css_set_lock is released and we may arrive at a new ->task_pos.
The iterator should not attempt to resurrect tasks whose ->usage count
dropped to zero. (When that happens, __put_task_struct_rcu_cb() is
already imminent and the returned task_struct would could be used
after free.)
As for the fix, we cannot simply check the signal->live count of a task
on the dying list because that won't distinguish regular zombies waiting
to be reaped from RCU remnant tasks that are going to be free'd.
Therefore add an extra check to rule out ->usage==0 tasks from any
iteration.
The repeat: loop in css_task_iter_advance() doesn't consider ->usage
count, so add a new loop to css_task_iter_next() to skip de-used tasks
on the dying_list.
Rough illustration of the possible race
R (reader of cgroup.procs) T (thread) L (group leader)
--------------------------------- -------------------------------- --------------------------------
L exits, signal->live > 0
cgroup_task_dead(L)
css_set_skip_task_iters() // skips only cset->tasks
list_add_tail(&L->cg_list, &cset->dying_tasks)
css_task_iter_next()
take css_set_lock
css_task_iter_advance()
leader && signal->live != 0
=> it->task_pos = &L->cg_list
release css_set_lock
T exits
--signal->live == 0
cgroup_task_dead(T) // css_set_lock
release_task(T)
cgroup_task_release(T)
release_task(L) // zap_leader
cgroup_task_release(L)
put_task_struct_rcu_user(L)
...RCU...
put_task_struct(L)
L->usage = 0
/* L still on dying_tasks */
...RCU...
__put_task_struct(L)
css_task_iter_next() // another iteration
take css_set_lock
it->task_pos = &L->cg_list
get_task_struct(L)
=> addition on 0
drop css_set_lock
cgroup_task_free(L)
css_set_skip_task_iters() // dying skip comes too late
free_task(L)
cgroup_procs_show()
task_pid_vnr(L)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 828938118d6c2bb711301748c3e39e4bed6a62f5
(git)
Affected: 260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 057dac23d329d5c5ed62352f2659a39fd46c6d4a (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828938118d6c2bb711301748c3e39e4bed6a62f5",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
},
{
"lessThan": "057dac23d329d5c5ed62352f2659a39fd46c6d4a",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have -\u003eusage count \u003e 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new -\u003etask_pos.\nThe iterator should not attempt to resurrect tasks whose -\u003eusage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal-\u003elive count of a task\non the dying list because that won\u0027t distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free\u0027d.\nTherefore add an extra check to rule out -\u003eusage==0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn\u0027t consider -\u003eusage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n R (reader of cgroup.procs) T (thread) L (group leader)\n --------------------------------- -------------------------------- --------------------------------\n L exits, signal-\u003elive \u003e 0\n cgroup_task_dead(L)\n css_set_skip_task_iters() // skips only cset-\u003etasks\n list_add_tail(\u0026L-\u003ecg_list, \u0026cset-\u003edying_tasks)\n css_task_iter_next()\n take css_set_lock\n css_task_iter_advance()\n leader \u0026\u0026 signal-\u003elive != 0\n =\u003e it-\u003etask_pos = \u0026L-\u003ecg_list\n release css_set_lock\n T exits\n --signal-\u003elive == 0\n\t\t\t\t cgroup_task_dead(T) // css_set_lock\n release_task(T)\n cgroup_task_release(T)\n release_task(L) // zap_leader\n cgroup_task_release(L)\n put_task_struct_rcu_user(L)\n ...RCU...\n put_task_struct(L)\n L-\u003eusage = 0\n /* L still on dying_tasks */\n ...RCU...\n __put_task_struct(L)\n css_task_iter_next() // another iteration\n take css_set_lock\n it-\u003etask_pos = \u0026L-\u003ecg_list\n get_task_struct(L)\n =\u003e addition on 0\n drop css_set_lock\n cgroup_task_free(L)\n css_set_skip_task_iters() // dying skip comes too late\n free_task(L)\n cgroup_procs_show()\n task_pid_vnr(L)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T08:31:50.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828938118d6c2bb711301748c3e39e4bed6a62f5"
},
{
"url": "https://git.kernel.org/stable/c/057dac23d329d5c5ed62352f2659a39fd46c6d4a"
}
],
"title": "cgroup: Avoid iteration of dying tasks with zero refcount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98163",
"datePublished": "2026-09-26T08:31:50.899Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-26T08:31:50.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98162 (GCVE-0-2026-98162)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
smb/server: fix tree connection leak in smb2_tree_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix tree connection leak in smb2_tree_connect()
See the procedure below:
smb2_tree_connect
ksmbd_tree_conn_connect
xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
ksmbd_share_tree_conn_inc(sc)
ksmbd_iov_pin_rsp // fail
status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
// do not disconnect tree_conn
Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc
(git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 39f2032096715daae5f6fd0f587ca7a474b019df (git) Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 (git) Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 (git) Affected: 5.15.145 , < 5.16 (semver) Affected: 6.1.71 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"lessThan": "39f2032096715daae5f6fd0f587ca7a474b019df",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"status": "affected",
"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
"versionType": "git"
},
{
"status": "affected",
"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.71",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix tree connection leak in smb2_tree_connect()\n\nSee the procedure below:\n\n smb2_tree_connect\n ksmbd_tree_conn_connect\n xa_store(\u0026sess-\u003etree_conns, tree_conn-\u003eid, tree_conn)\n ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)\n ksmbd_share_tree_conn_inc(sc)\n ksmbd_iov_pin_rsp // fail\n status.ret = KSMBD_TREE_CONN_STATUS_NOMEM\n // do not disconnect tree_conn\n\nDisconnect the new tree connection if ksmbd_iov_pin_rsp() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:51.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc"
},
{
"url": "https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"
}
],
"title": "smb/server: fix tree connection leak in smb2_tree_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98162",
"datePublished": "2026-09-25T13:06:51.778Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:51.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98161 (GCVE-0-2026-98161)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-28 05:31
VLAI
EPSS
VEX
Title
nvdimm: pmem: keep PREFLUSH before data writes
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pmem: keep PREFLUSH before data writes
pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the
bio data and can later overwrite the error with a successful REQ_FUA flush.
That lets data writes run after a failed preflush and can complete the bio
successfully despite the failed ordering barrier.
Run the REQ_PREFLUSH flush synchronously before touching the bio data and
complete the bio with the flush error if it fails. Keep asynchronous flush
chaining for REQ_FUA. At that point, data copy has completed and the parent
bio can wait for the chained flush bio.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c5d4355d10d414a96ca870b731756b89d068d57a , < 770a90c2127220f0fc194ce909ad4f0842e141cb
(git)
Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 72561ca1ab96f0f0f32737a6171641e05a318538 (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < c644a2f8fef5618fcf453c591177700fd07dd024 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "770a90c2127220f0fc194ce909ad4f0842e141cb",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "72561ca1ab96f0f0f32737a6171641e05a318538",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "c644a2f8fef5618fcf453c591177700fd07dd024",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T05:31:10.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb"
},
{
"url": "https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538"
},
{
"url": "https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"
}
],
"title": "nvdimm: pmem: keep PREFLUSH before data writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98161",
"datePublished": "2026-09-25T13:06:51.138Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-28T05:31:10.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98160 (GCVE-0-2026-98160)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ff6d1ba247b5c62bdb678f1069abc86ad88a1402
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < d6158333d630a1b21d8914feaf77a6f5deb185d9 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c017ab2b0e1b60b5be94636c94720347213d78b (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 4520d673d49dabfd42c008a33889251025f7d6d5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 423574feaed192063ef0cd0813fb85425f39e539 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 737c928ff5092d7e55128a232c231248fc993777 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 911190f0b9511c3c81f2f2484414c1ae26f636b3 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 264676418b726baca7be49171e306b6aa05cceb0 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff6d1ba247b5c62bdb678f1069abc86ad88a1402",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d6158333d630a1b21d8914feaf77a6f5deb185d9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6c017ab2b0e1b60b5be94636c94720347213d78b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4520d673d49dabfd42c008a33889251025f7d6d5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "423574feaed192063ef0cd0813fb85425f39e539",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "737c928ff5092d7e55128a232c231248fc993777",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "911190f0b9511c3c81f2f2484414c1ae26f636b3",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "264676418b726baca7be49171e306b6aa05cceb0",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()\n\npadapter-\u003eHalData is allocated via vzalloc(), but incorrectly freed\nusing kfree() in the rtw_sdio_if1_init() error path. Using kfree() to\nrelease this vmalloc-backed buffer can lead to memory corruption.\n\nUse rtw_hal_data_deinit() to pair the free correctly and free\nHalData with vfree().\n\nThe bug was first flagged by an experimental static analysis tool we\nare developing for kernel memory-management bugs. Manual inspection\nconfirms that the issue is still present in current mainline.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsuitable RTL8723BS SDIO hardware to test with, no runtime testing was\nable to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:50.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff6d1ba247b5c62bdb678f1069abc86ad88a1402"
},
{
"url": "https://git.kernel.org/stable/c/d6158333d630a1b21d8914feaf77a6f5deb185d9"
},
{
"url": "https://git.kernel.org/stable/c/6c017ab2b0e1b60b5be94636c94720347213d78b"
},
{
"url": "https://git.kernel.org/stable/c/4520d673d49dabfd42c008a33889251025f7d6d5"
},
{
"url": "https://git.kernel.org/stable/c/423574feaed192063ef0cd0813fb85425f39e539"
},
{
"url": "https://git.kernel.org/stable/c/737c928ff5092d7e55128a232c231248fc993777"
},
{
"url": "https://git.kernel.org/stable/c/911190f0b9511c3c81f2f2484414c1ae26f636b3"
},
{
"url": "https://git.kernel.org/stable/c/264676418b726baca7be49171e306b6aa05cceb0"
}
],
"title": "staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98160",
"datePublished": "2026-09-25T13:06:50.521Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:50.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100079 (GCVE-0-2026-100079)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
usb: typec: ucsi: unregister debugfs entries on teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsi_register() creates per-instance debugfs entries, but
ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI
instance across remoteproc restart then try to create an already
existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and
clear ucsi->debugfs after freeing it so repeated unregister
paths remain safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df0383ffad64dc09954a60873c1e202b47f08d90 , < fb7393519908befdc094be4ea913f582adbf2f7c
(git)
Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 7177c215e69658adbd2f2fc5b72e14be9208d2ba (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 1f44d001620fd3caa30619a9bc73e9d15555408b (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 62efee351566321ad72a4abaf6eb7d972590585d (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < eed73a65ab609b79d53de88cccc34b36dfe753c4 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb7393519908befdc094be4ea913f582adbf2f7c",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "7177c215e69658adbd2f2fc5b72e14be9208d2ba",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "1f44d001620fd3caa30619a9bc73e9d15555408b",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "62efee351566321ad72a4abaf6eb7d972590585d",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "eed73a65ab609b79d53de88cccc34b36dfe753c4",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: unregister debugfs entries on teardown\n\nucsi_register() creates per-instance debugfs entries, but\nucsi_unregister() keeps them around until ucsi_destroy().\n\nDrivers like ucsi_glink that unregister/register the same UCSI\ninstance across remoteproc restart then try to create an already\nexisting debugfs directory and log:\n\n debugfs: \u0027pmic_glink.ucsi.0\u0027 already exists in \u0027ucsi\u0027\n\nUnregister debugfs entries as part of ucsi_unregister(), and\nclear ucsi-\u003edebugfs after freeing it so repeated unregister\npaths remain safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c"
},
{
"url": "https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba"
},
{
"url": "https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b"
},
{
"url": "https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d"
},
{
"url": "https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4"
}
],
"title": "usb: typec: ucsi: unregister debugfs entries on teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100079",
"datePublished": "2026-09-25T13:06:49.915Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100078 (GCVE-0-2026-100078)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
wifi: iwlwifi: mei: pass correct argument to function
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: pass correct argument to function
The first argument to iwl_mei_write_cyclic_buf() should be the cldev
but the q_head pointer is passed instead. Fix it.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
652291601459272d52b6ba12811f0b60b3e6444f , < 034445e19f12bb8771c58e2ecf1fbd6eac9b5fac
(git)
Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < f22ad9d1077c83718d9e6c84b71726287c1d1ad3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < ee91ae7f5815345612d8c0afd5d7efed361bcdb5 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 082b353c05b8eaf07e03fc1918c176cd3c216e25 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 905f57aefde4f4092a411c8a55856182fb1c7598 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034445e19f12bb8771c58e2ecf1fbd6eac9b5fac",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "f22ad9d1077c83718d9e6c84b71726287c1d1ad3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "ee91ae7f5815345612d8c0afd5d7efed361bcdb5",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "082b353c05b8eaf07e03fc1918c176cd3c216e25",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "905f57aefde4f4092a411c8a55856182fb1c7598",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mei: pass correct argument to function\n\nThe first argument to iwl_mei_write_cyclic_buf() should be the cldev\nbut the q_head pointer is passed instead. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac"
},
{
"url": "https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3"
},
{
"url": "https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5"
},
{
"url": "https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3"
},
{
"url": "https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25"
},
{
"url": "https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598"
}
],
"title": "wifi: iwlwifi: mei: pass correct argument to function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100078",
"datePublished": "2026-09-25T13:06:49.327Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100077 (GCVE-0-2026-100077)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
drm/msm: Recover HW before retire hung submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we
recover the GPU. Retiring the submit triggers BO free and that can
result in GPU pagefaults since the GPU may be actively accessing those
BOs.
To fix this, retire the submits after gpu recovery is complete in
recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < e36284257eeca13768687bf8e52f66f8ea0e8794
(git)
Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < dc64cf9d71428234389b635d142cb5fe07d57eab (git) Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < b303e1d52811de7d1bcf793560754d4df68d4a1c (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794"
},
{
"url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab"
},
{
"url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c"
}
],
"title": "drm/msm: Recover HW before retire hung submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100077",
"datePublished": "2026-09-25T13:06:48.707Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100076 (GCVE-0-2026-100076)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).
Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c9f6a3b9fdd31a0836b681053155b5997c0156e
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < c48e5aa01525577d6b6e782962a5bfb0e1535cb5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 41b8209376dffbd7b0b85c8bc4697d9166ac62ef (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c9f6a3b9fdd31a0836b681053155b5997c0156e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c48e5aa01525577d6b6e782962a5bfb0e1535cb5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41b8209376dffbd7b0b85c8bc4697d9166ac62ef",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver\u0027s fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n - issue_beacon(): beacon larger than 512 bytes\n - issue_probersp(): cur_network-\u003eie_length \u003e MAX_IE_SZ\n - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e"
},
{
"url": "https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5"
},
{
"url": "https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef"
}
],
"title": "staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100076",
"datePublished": "2026-09-25T13:06:48.057Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100075 (GCVE-0-2026-100075)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41
VLAI
EPSS
VEX
Title
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
descriptor, the unwind path destroys RDMA contexts but leaves stale
n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap
allocation before returning an error.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa
(git)
Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:41:03.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
},
{
"url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
},
{
"url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
},
{
"url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
},
{
"url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
},
{
"url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
},
{
"url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
},
{
"url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
}
],
"title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100075",
"datePublished": "2026-09-25T13:06:47.399Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T14:41:03.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100074 (GCVE-0-2026-100074)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
bpf: Mark bpf_refcount field as unique
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix
this oversight.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d54730b50bae1f3119bd686d551d66f0fcc387ca , < e42cede6f90177f4f92f80d3de18f628e61d2087
(git)
Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 641f814965d733936ca3618d4d5a12a8fa9be00e (git) Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 61e655391cb19c31f94ecd4354f624c81ce4cf75 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42cede6f90177f4f92f80d3de18f628e61d2087",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "641f814965d733936ca3618d4d5a12a8fa9be00e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "61e655391cb19c31f94ecd4354f624c81ce4cf75",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087"
},
{
"url": "https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e"
},
{
"url": "https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75"
}
],
"title": "bpf: Mark bpf_refcount field as unique",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100074",
"datePublished": "2026-09-25T13:06:46.777Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100073 (GCVE-0-2026-100073)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
ext4: fix transaction overflow during writeback
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix transaction overflow during writeback
Commit 95ad8ee45cdb ("ext4: correct the reserved credits for extent
conversion") was correct to note that we need to reserve enough credits
for all extents possibly underlying a large folio. However it was too
eager to reduce the number of reserved credits. Extent conversion may
not only need to touch several leaf extent blocks, it may also need to
split extents - for example a single large unwritten extent may need to
be split into many small written ones in case of sparse folio dirtying.
This can thus result not only in extent leaf modifications but also in a
need to allocate new extent tree nodes. As a result the reserved
transaction credits were not sufficient in some corner cases. Use
ext4_meta_trans_blocks() for correct upper bound credit estimate.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
95ad8ee45cdbc321c135a2db895d48b374ef0f87 , < a22464c5df5827e884a5a7d3d8fb03870e5bb6c8
(git)
Affected: 95ad8ee45cdbc321c135a2db895d48b374ef0f87 , < 46e8e31771f4f1c5e1cdec37a889a6730e42e9f1 (git) Affected: 2b6d39229bc783198222cddd31e2fbded93c8db7 (git) Affected: 6.16.3 , < 6.17 (semver) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a22464c5df5827e884a5a7d3d8fb03870e5bb6c8",
"status": "affected",
"version": "95ad8ee45cdbc321c135a2db895d48b374ef0f87",
"versionType": "git"
},
{
"lessThan": "46e8e31771f4f1c5e1cdec37a889a6730e42e9f1",
"status": "affected",
"version": "95ad8ee45cdbc321c135a2db895d48b374ef0f87",
"versionType": "git"
},
{
"status": "affected",
"version": "2b6d39229bc783198222cddd31e2fbded93c8db7",
"versionType": "git"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix transaction overflow during writeback\n\nCommit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent\nconversion\") was correct to note that we need to reserve enough credits\nfor all extents possibly underlying a large folio. However it was too\neager to reduce the number of reserved credits. Extent conversion may\nnot only need to touch several leaf extent blocks, it may also need to\nsplit extents - for example a single large unwritten extent may need to\nbe split into many small written ones in case of sparse folio dirtying.\nThis can thus result not only in extent leaf modifications but also in a\nneed to allocate new extent tree nodes. As a result the reserved\ntransaction credits were not sufficient in some corner cases. Use\next4_meta_trans_blocks() for correct upper bound credit estimate."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a22464c5df5827e884a5a7d3d8fb03870e5bb6c8"
},
{
"url": "https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"
}
],
"title": "ext4: fix transaction overflow during writeback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100073",
"datePublished": "2026-09-25T13:06:46.185Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100072 (GCVE-0-2026-100072)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
ACPI: platform: Use acpi_bus_get_primary_device()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: platform: Use acpi_bus_get_primary_device()
The acpi_get_first_physical_node() usage in acpi_platform_fill_resource()
and acpi_create_platform_device() is generally unsafe because in theory
the device returned by it may be freed at any time [1].
It is also inefficient because acpi_get_first_physical_node() is called
multiple times for the same argument which can be avoided.
Address these issues by using acpi_bus_get_primary_device() instead of
acpi_get_first_physical_node() and adjusting the code to call it just
once at the beginning of and acpi_create_platform_device() and drop
the device reference acquired by it upon the return from that function.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3b95bd160547f56a68aeb972c33ae9511e7a8380 , < c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71
(git)
Affected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 , < a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
},
{
"lessThan": "a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:45.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"
},
{
"url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"
}
],
"title": "ACPI: platform: Use acpi_bus_get_primary_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100072",
"datePublished": "2026-09-25T13:06:45.579Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:45.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100071 (GCVE-0-2026-100071)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
net: hsr: free learned nodes on device setup failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: free learned nodes on device setup failure
hsr_dev_finalize() can fail after a lower-device RX handler has
already been registered (slave A is added before the failable slave B
and interlink adds). RX handlers run in softirq regardless of the
master's state, so frames received in that window can learn dynamic
nodes into node_db, and the error unwind never releases them.
Free both owned dynamic databases in the unwind, mirroring
hsr_dellink(). proxy_node_db is provably empty on every current error
exit (only interlink RX feeds it, and the interlink add is the last
failable step) and is freed for symmetry. The order is safe:
hsr_del_port() unregisters each RX handler with synchronize_net()
before hsr_del_nodes() runs, which removes remaining entries with
list_del_rcu() and defers their release with call_rcu() for readers
already under RCU.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < e691eee886871b933d772ffc76d66c80b4c0a25e
(git)
Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 0a340ffd96943a49a78e367efac9517ca767d99b (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < f7289e3492f2694dccd3d79287e0e31879b58650 (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 65702339b3e9fd792f65d4b740928798194d86ce (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 49b01f2939abc676a6f9a118f07a10110ee5f683 (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 7f16289b91eb316f170a6bd22d32e6c632f6a5b6 (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e691eee886871b933d772ffc76d66c80b4c0a25e",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "0a340ffd96943a49a78e367efac9517ca767d99b",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "f7289e3492f2694dccd3d79287e0e31879b58650",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "65702339b3e9fd792f65d4b740928798194d86ce",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "49b01f2939abc676a6f9a118f07a10110ee5f683",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "7f16289b91eb316f170a6bd22d32e6c632f6a5b6",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster\u0027s state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:44.956Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"
},
{
"url": "https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"
},
{
"url": "https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"
},
{
"url": "https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"
},
{
"url": "https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"
},
{
"url": "https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"
}
],
"title": "net: hsr: free learned nodes on device setup failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100071",
"datePublished": "2026-09-25T13:06:44.956Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:44.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100070 (GCVE-0-2026-100070)
Vulnerability from nvd – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
sashiko says:
If map_addr() changes the packet length, such as when the public NAT IP
string is shorter or longer than the internal IP, coff will still point to
the offset relative to the pre-mangled packet.
If the packet shrinks, coff could overshoot the correct position,
potentially causing the next ct_sip_parse_header_uri() call to silently
skip bytes and miss subsequent Contact headers. Could this lead to a
failure to NAT those subsequent headers and leak internal network details?
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c978cd3a937141deaf7995b849824af6dacdeae7 , < 6828aca3d82717c2fda92af81c0dda642bc2b465
(git)
Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 2703f5ea8d85bc729f433ac09ee902084c947122 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 0f4d30e2e49f343fc28ba1e259fd22969b940c46 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 810da5a63549531da78348b0a4545042d84e01e2 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 668cc1c30caedc63070b10d17d5514748988a140 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < e70d48fcf8382581162608a4a322919bfd22aef3 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < c408d416618ebb8a95e3097a13f3b793ea9272ee (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 16aecbe3036f6097c26b51b12e4c1cf207769690 (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6828aca3d82717c2fda92af81c0dda642bc2b465",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "2703f5ea8d85bc729f433ac09ee902084c947122",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "0f4d30e2e49f343fc28ba1e259fd22969b940c46",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "810da5a63549531da78348b0a4545042d84e01e2",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "668cc1c30caedc63070b10d17d5514748988a140",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "e70d48fcf8382581162608a4a322919bfd22aef3",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "c408d416618ebb8a95e3097a13f3b793ea9272ee",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "16aecbe3036f6097c26b51b12e4c1cf207769690",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: rewind offset when NAT shrinks the packet\n\nsashiko says:\n If map_addr() changes the packet length, such as when the public NAT IP\n string is shorter or longer than the internal IP, coff will still point to\n the offset relative to the pre-mangled packet.\n If the packet shrinks, coff could overshoot the correct position,\n potentially causing the next ct_sip_parse_header_uri() call to silently\n skip bytes and miss subsequent Contact headers. Could this lead to a\n failure to NAT those subsequent headers and leak internal network details?"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:44.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6828aca3d82717c2fda92af81c0dda642bc2b465"
},
{
"url": "https://git.kernel.org/stable/c/2703f5ea8d85bc729f433ac09ee902084c947122"
},
{
"url": "https://git.kernel.org/stable/c/0f4d30e2e49f343fc28ba1e259fd22969b940c46"
},
{
"url": "https://git.kernel.org/stable/c/810da5a63549531da78348b0a4545042d84e01e2"
},
{
"url": "https://git.kernel.org/stable/c/668cc1c30caedc63070b10d17d5514748988a140"
},
{
"url": "https://git.kernel.org/stable/c/e70d48fcf8382581162608a4a322919bfd22aef3"
},
{
"url": "https://git.kernel.org/stable/c/c408d416618ebb8a95e3097a13f3b793ea9272ee"
},
{
"url": "https://git.kernel.org/stable/c/16aecbe3036f6097c26b51b12e4c1cf207769690"
}
],
"title": "netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100070",
"datePublished": "2026-09-25T13:06:44.311Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:44.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98164 (GCVE-0-2026-98164)
Vulnerability from cvelistv5 – Published: 2026-09-29 12:02 – Updated: 2026-09-29 12:02
VLAI
EPSS
VEX
Title
KVM: x86/mmu: Check write tracking in all address spaces
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() checks only the supplied memslot, but page
tracking is per-address-space and shadow pages are shared across all
address spaces. With SMM, a GFN can therefore be write-tracked in one
address space and appear untracked through the other.
Check the supplied slot first, then the slot for the other address space.
This ensures all callers honor write tracking regardless of the active
address space. In particular, it prevents mmu_try_to_unsync_pages() from
marking an upper-level shadow page unsync and eventually triggering the
BUG in pte_list_remove().
[invert direction of the conditional. - Paolo]
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < 09aa68552d2542cc6c23edd1568ac265dc5d886f
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 429b6f43b4d8c98988fdca99e02dc156134e3d77 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < c0a9bd5fca0b5f2dea32b0fc31350e71e8648112 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < ec8fcaf354c1cbb36755d48e9f5a00c9591349e5 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 0f38453cdb2e17566ccb7c0f3dabd5bd21caca26 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09aa68552d2542cc6c23edd1568ac265dc5d886f",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "429b6f43b4d8c98988fdca99e02dc156134e3d77",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "c0a9bd5fca0b5f2dea32b0fc31350e71e8648112",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "ec8fcaf354c1cbb36755d48e9f5a00c9591349e5",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "0f38453cdb2e17566ccb7c0f3dabd5bd21caca26",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Check write tracking in all address spaces\n\nkvm_gfn_is_write_tracked() checks only the supplied memslot, but page\ntracking is per-address-space and shadow pages are shared across all\naddress spaces. With SMM, a GFN can therefore be write-tracked in one\naddress space and appear untracked through the other.\n\nCheck the supplied slot first, then the slot for the other address space.\nThis ensures all callers honor write tracking regardless of the active\naddress space. In particular, it prevents mmu_try_to_unsync_pages() from\nmarking an upper-level shadow page unsync and eventually triggering the\nBUG in pte_list_remove().\n\n[invert direction of the conditional. - Paolo]"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T12:02:12.574Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09aa68552d2542cc6c23edd1568ac265dc5d886f"
},
{
"url": "https://git.kernel.org/stable/c/429b6f43b4d8c98988fdca99e02dc156134e3d77"
},
{
"url": "https://git.kernel.org/stable/c/d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a"
},
{
"url": "https://git.kernel.org/stable/c/c0a9bd5fca0b5f2dea32b0fc31350e71e8648112"
},
{
"url": "https://git.kernel.org/stable/c/ec8fcaf354c1cbb36755d48e9f5a00c9591349e5"
},
{
"url": "https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"
}
],
"title": "KVM: x86/mmu: Check write tracking in all address spaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98164",
"datePublished": "2026-09-29T12:02:12.574Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-29T12:02:12.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98163 (GCVE-0-2026-98163)
Vulnerability from cvelistv5 – Published: 2026-09-26 08:31 – Updated: 2026-09-26 08:31
VLAI
EPSS
VEX
Title
cgroup: Avoid iteration of dying tasks with zero refcount
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avoid iteration of dying tasks with zero refcount
The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is
possible before cgroup_task_release()/put_task_struct_rcu_user()).
The tasks after cgroup_task_release() and before cgroup_task_free()
are subject to race when they may or may not have ->usage count > 0.
The race window is between css_task_iter_next() invocations
when css_set_lock is released and we may arrive at a new ->task_pos.
The iterator should not attempt to resurrect tasks whose ->usage count
dropped to zero. (When that happens, __put_task_struct_rcu_cb() is
already imminent and the returned task_struct would could be used
after free.)
As for the fix, we cannot simply check the signal->live count of a task
on the dying list because that won't distinguish regular zombies waiting
to be reaped from RCU remnant tasks that are going to be free'd.
Therefore add an extra check to rule out ->usage==0 tasks from any
iteration.
The repeat: loop in css_task_iter_advance() doesn't consider ->usage
count, so add a new loop to css_task_iter_next() to skip de-used tasks
on the dying_list.
Rough illustration of the possible race
R (reader of cgroup.procs) T (thread) L (group leader)
--------------------------------- -------------------------------- --------------------------------
L exits, signal->live > 0
cgroup_task_dead(L)
css_set_skip_task_iters() // skips only cset->tasks
list_add_tail(&L->cg_list, &cset->dying_tasks)
css_task_iter_next()
take css_set_lock
css_task_iter_advance()
leader && signal->live != 0
=> it->task_pos = &L->cg_list
release css_set_lock
T exits
--signal->live == 0
cgroup_task_dead(T) // css_set_lock
release_task(T)
cgroup_task_release(T)
release_task(L) // zap_leader
cgroup_task_release(L)
put_task_struct_rcu_user(L)
...RCU...
put_task_struct(L)
L->usage = 0
/* L still on dying_tasks */
...RCU...
__put_task_struct(L)
css_task_iter_next() // another iteration
take css_set_lock
it->task_pos = &L->cg_list
get_task_struct(L)
=> addition on 0
drop css_set_lock
cgroup_task_free(L)
css_set_skip_task_iters() // dying skip comes too late
free_task(L)
cgroup_procs_show()
task_pid_vnr(L)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 828938118d6c2bb711301748c3e39e4bed6a62f5
(git)
Affected: 260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 057dac23d329d5c5ed62352f2659a39fd46c6d4a (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828938118d6c2bb711301748c3e39e4bed6a62f5",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
},
{
"lessThan": "057dac23d329d5c5ed62352f2659a39fd46c6d4a",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have -\u003eusage count \u003e 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new -\u003etask_pos.\nThe iterator should not attempt to resurrect tasks whose -\u003eusage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal-\u003elive count of a task\non the dying list because that won\u0027t distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free\u0027d.\nTherefore add an extra check to rule out -\u003eusage==0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn\u0027t consider -\u003eusage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n R (reader of cgroup.procs) T (thread) L (group leader)\n --------------------------------- -------------------------------- --------------------------------\n L exits, signal-\u003elive \u003e 0\n cgroup_task_dead(L)\n css_set_skip_task_iters() // skips only cset-\u003etasks\n list_add_tail(\u0026L-\u003ecg_list, \u0026cset-\u003edying_tasks)\n css_task_iter_next()\n take css_set_lock\n css_task_iter_advance()\n leader \u0026\u0026 signal-\u003elive != 0\n =\u003e it-\u003etask_pos = \u0026L-\u003ecg_list\n release css_set_lock\n T exits\n --signal-\u003elive == 0\n\t\t\t\t cgroup_task_dead(T) // css_set_lock\n release_task(T)\n cgroup_task_release(T)\n release_task(L) // zap_leader\n cgroup_task_release(L)\n put_task_struct_rcu_user(L)\n ...RCU...\n put_task_struct(L)\n L-\u003eusage = 0\n /* L still on dying_tasks */\n ...RCU...\n __put_task_struct(L)\n css_task_iter_next() // another iteration\n take css_set_lock\n it-\u003etask_pos = \u0026L-\u003ecg_list\n get_task_struct(L)\n =\u003e addition on 0\n drop css_set_lock\n cgroup_task_free(L)\n css_set_skip_task_iters() // dying skip comes too late\n free_task(L)\n cgroup_procs_show()\n task_pid_vnr(L)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T08:31:50.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828938118d6c2bb711301748c3e39e4bed6a62f5"
},
{
"url": "https://git.kernel.org/stable/c/057dac23d329d5c5ed62352f2659a39fd46c6d4a"
}
],
"title": "cgroup: Avoid iteration of dying tasks with zero refcount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98163",
"datePublished": "2026-09-26T08:31:50.899Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-26T08:31:50.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98162 (GCVE-0-2026-98162)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
smb/server: fix tree connection leak in smb2_tree_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix tree connection leak in smb2_tree_connect()
See the procedure below:
smb2_tree_connect
ksmbd_tree_conn_connect
xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
ksmbd_share_tree_conn_inc(sc)
ksmbd_iov_pin_rsp // fail
status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
// do not disconnect tree_conn
Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc
(git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 39f2032096715daae5f6fd0f587ca7a474b019df (git) Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 (git) Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 (git) Affected: 5.15.145 , < 5.16 (semver) Affected: 6.1.71 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"lessThan": "39f2032096715daae5f6fd0f587ca7a474b019df",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"status": "affected",
"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
"versionType": "git"
},
{
"status": "affected",
"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.71",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix tree connection leak in smb2_tree_connect()\n\nSee the procedure below:\n\n smb2_tree_connect\n ksmbd_tree_conn_connect\n xa_store(\u0026sess-\u003etree_conns, tree_conn-\u003eid, tree_conn)\n ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)\n ksmbd_share_tree_conn_inc(sc)\n ksmbd_iov_pin_rsp // fail\n status.ret = KSMBD_TREE_CONN_STATUS_NOMEM\n // do not disconnect tree_conn\n\nDisconnect the new tree connection if ksmbd_iov_pin_rsp() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:51.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc"
},
{
"url": "https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"
}
],
"title": "smb/server: fix tree connection leak in smb2_tree_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98162",
"datePublished": "2026-09-25T13:06:51.778Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:51.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98161 (GCVE-0-2026-98161)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-28 05:31
VLAI
EPSS
VEX
Title
nvdimm: pmem: keep PREFLUSH before data writes
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pmem: keep PREFLUSH before data writes
pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the
bio data and can later overwrite the error with a successful REQ_FUA flush.
That lets data writes run after a failed preflush and can complete the bio
successfully despite the failed ordering barrier.
Run the REQ_PREFLUSH flush synchronously before touching the bio data and
complete the bio with the flush error if it fails. Keep asynchronous flush
chaining for REQ_FUA. At that point, data copy has completed and the parent
bio can wait for the chained flush bio.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c5d4355d10d414a96ca870b731756b89d068d57a , < 770a90c2127220f0fc194ce909ad4f0842e141cb
(git)
Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 72561ca1ab96f0f0f32737a6171641e05a318538 (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < c644a2f8fef5618fcf453c591177700fd07dd024 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "770a90c2127220f0fc194ce909ad4f0842e141cb",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "72561ca1ab96f0f0f32737a6171641e05a318538",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "c644a2f8fef5618fcf453c591177700fd07dd024",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T05:31:10.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb"
},
{
"url": "https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538"
},
{
"url": "https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"
}
],
"title": "nvdimm: pmem: keep PREFLUSH before data writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98161",
"datePublished": "2026-09-25T13:06:51.138Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-28T05:31:10.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98160 (GCVE-0-2026-98160)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ff6d1ba247b5c62bdb678f1069abc86ad88a1402
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < d6158333d630a1b21d8914feaf77a6f5deb185d9 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c017ab2b0e1b60b5be94636c94720347213d78b (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 4520d673d49dabfd42c008a33889251025f7d6d5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 423574feaed192063ef0cd0813fb85425f39e539 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 737c928ff5092d7e55128a232c231248fc993777 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 911190f0b9511c3c81f2f2484414c1ae26f636b3 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 264676418b726baca7be49171e306b6aa05cceb0 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff6d1ba247b5c62bdb678f1069abc86ad88a1402",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d6158333d630a1b21d8914feaf77a6f5deb185d9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6c017ab2b0e1b60b5be94636c94720347213d78b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4520d673d49dabfd42c008a33889251025f7d6d5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "423574feaed192063ef0cd0813fb85425f39e539",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "737c928ff5092d7e55128a232c231248fc993777",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "911190f0b9511c3c81f2f2484414c1ae26f636b3",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "264676418b726baca7be49171e306b6aa05cceb0",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()\n\npadapter-\u003eHalData is allocated via vzalloc(), but incorrectly freed\nusing kfree() in the rtw_sdio_if1_init() error path. Using kfree() to\nrelease this vmalloc-backed buffer can lead to memory corruption.\n\nUse rtw_hal_data_deinit() to pair the free correctly and free\nHalData with vfree().\n\nThe bug was first flagged by an experimental static analysis tool we\nare developing for kernel memory-management bugs. Manual inspection\nconfirms that the issue is still present in current mainline.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsuitable RTL8723BS SDIO hardware to test with, no runtime testing was\nable to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:50.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff6d1ba247b5c62bdb678f1069abc86ad88a1402"
},
{
"url": "https://git.kernel.org/stable/c/d6158333d630a1b21d8914feaf77a6f5deb185d9"
},
{
"url": "https://git.kernel.org/stable/c/6c017ab2b0e1b60b5be94636c94720347213d78b"
},
{
"url": "https://git.kernel.org/stable/c/4520d673d49dabfd42c008a33889251025f7d6d5"
},
{
"url": "https://git.kernel.org/stable/c/423574feaed192063ef0cd0813fb85425f39e539"
},
{
"url": "https://git.kernel.org/stable/c/737c928ff5092d7e55128a232c231248fc993777"
},
{
"url": "https://git.kernel.org/stable/c/911190f0b9511c3c81f2f2484414c1ae26f636b3"
},
{
"url": "https://git.kernel.org/stable/c/264676418b726baca7be49171e306b6aa05cceb0"
}
],
"title": "staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98160",
"datePublished": "2026-09-25T13:06:50.521Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:50.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100079 (GCVE-0-2026-100079)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
usb: typec: ucsi: unregister debugfs entries on teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsi_register() creates per-instance debugfs entries, but
ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI
instance across remoteproc restart then try to create an already
existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and
clear ucsi->debugfs after freeing it so repeated unregister
paths remain safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df0383ffad64dc09954a60873c1e202b47f08d90 , < fb7393519908befdc094be4ea913f582adbf2f7c
(git)
Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 7177c215e69658adbd2f2fc5b72e14be9208d2ba (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 1f44d001620fd3caa30619a9bc73e9d15555408b (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 62efee351566321ad72a4abaf6eb7d972590585d (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < eed73a65ab609b79d53de88cccc34b36dfe753c4 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb7393519908befdc094be4ea913f582adbf2f7c",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "7177c215e69658adbd2f2fc5b72e14be9208d2ba",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "1f44d001620fd3caa30619a9bc73e9d15555408b",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "62efee351566321ad72a4abaf6eb7d972590585d",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "eed73a65ab609b79d53de88cccc34b36dfe753c4",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: unregister debugfs entries on teardown\n\nucsi_register() creates per-instance debugfs entries, but\nucsi_unregister() keeps them around until ucsi_destroy().\n\nDrivers like ucsi_glink that unregister/register the same UCSI\ninstance across remoteproc restart then try to create an already\nexisting debugfs directory and log:\n\n debugfs: \u0027pmic_glink.ucsi.0\u0027 already exists in \u0027ucsi\u0027\n\nUnregister debugfs entries as part of ucsi_unregister(), and\nclear ucsi-\u003edebugfs after freeing it so repeated unregister\npaths remain safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c"
},
{
"url": "https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba"
},
{
"url": "https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b"
},
{
"url": "https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d"
},
{
"url": "https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4"
}
],
"title": "usb: typec: ucsi: unregister debugfs entries on teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100079",
"datePublished": "2026-09-25T13:06:49.915Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100078 (GCVE-0-2026-100078)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
wifi: iwlwifi: mei: pass correct argument to function
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: pass correct argument to function
The first argument to iwl_mei_write_cyclic_buf() should be the cldev
but the q_head pointer is passed instead. Fix it.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
652291601459272d52b6ba12811f0b60b3e6444f , < 034445e19f12bb8771c58e2ecf1fbd6eac9b5fac
(git)
Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < f22ad9d1077c83718d9e6c84b71726287c1d1ad3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < ee91ae7f5815345612d8c0afd5d7efed361bcdb5 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 082b353c05b8eaf07e03fc1918c176cd3c216e25 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 905f57aefde4f4092a411c8a55856182fb1c7598 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034445e19f12bb8771c58e2ecf1fbd6eac9b5fac",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "f22ad9d1077c83718d9e6c84b71726287c1d1ad3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "ee91ae7f5815345612d8c0afd5d7efed361bcdb5",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "082b353c05b8eaf07e03fc1918c176cd3c216e25",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "905f57aefde4f4092a411c8a55856182fb1c7598",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mei: pass correct argument to function\n\nThe first argument to iwl_mei_write_cyclic_buf() should be the cldev\nbut the q_head pointer is passed instead. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac"
},
{
"url": "https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3"
},
{
"url": "https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5"
},
{
"url": "https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3"
},
{
"url": "https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25"
},
{
"url": "https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598"
}
],
"title": "wifi: iwlwifi: mei: pass correct argument to function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100078",
"datePublished": "2026-09-25T13:06:49.327Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100077 (GCVE-0-2026-100077)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
drm/msm: Recover HW before retire hung submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we
recover the GPU. Retiring the submit triggers BO free and that can
result in GPU pagefaults since the GPU may be actively accessing those
BOs.
To fix this, retire the submits after gpu recovery is complete in
recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < e36284257eeca13768687bf8e52f66f8ea0e8794
(git)
Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < dc64cf9d71428234389b635d142cb5fe07d57eab (git) Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < b303e1d52811de7d1bcf793560754d4df68d4a1c (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794"
},
{
"url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab"
},
{
"url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c"
}
],
"title": "drm/msm: Recover HW before retire hung submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100077",
"datePublished": "2026-09-25T13:06:48.707Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100076 (GCVE-0-2026-100076)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).
Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c9f6a3b9fdd31a0836b681053155b5997c0156e
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < c48e5aa01525577d6b6e782962a5bfb0e1535cb5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 41b8209376dffbd7b0b85c8bc4697d9166ac62ef (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c9f6a3b9fdd31a0836b681053155b5997c0156e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c48e5aa01525577d6b6e782962a5bfb0e1535cb5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41b8209376dffbd7b0b85c8bc4697d9166ac62ef",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver\u0027s fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n - issue_beacon(): beacon larger than 512 bytes\n - issue_probersp(): cur_network-\u003eie_length \u003e MAX_IE_SZ\n - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e"
},
{
"url": "https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5"
},
{
"url": "https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef"
}
],
"title": "staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100076",
"datePublished": "2026-09-25T13:06:48.057Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100075 (GCVE-0-2026-100075)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41
VLAI
EPSS
VEX
Title
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
descriptor, the unwind path destroys RDMA contexts but leaves stale
n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap
allocation before returning an error.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa
(git)
Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:41:03.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
},
{
"url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
},
{
"url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
},
{
"url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
},
{
"url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
},
{
"url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
},
{
"url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
},
{
"url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
}
],
"title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100075",
"datePublished": "2026-09-25T13:06:47.399Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T14:41:03.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100074 (GCVE-0-2026-100074)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
bpf: Mark bpf_refcount field as unique
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix
this oversight.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d54730b50bae1f3119bd686d551d66f0fcc387ca , < e42cede6f90177f4f92f80d3de18f628e61d2087
(git)
Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 641f814965d733936ca3618d4d5a12a8fa9be00e (git) Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 61e655391cb19c31f94ecd4354f624c81ce4cf75 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42cede6f90177f4f92f80d3de18f628e61d2087",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "641f814965d733936ca3618d4d5a12a8fa9be00e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "61e655391cb19c31f94ecd4354f624c81ce4cf75",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087"
},
{
"url": "https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e"
},
{
"url": "https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75"
}
],
"title": "bpf: Mark bpf_refcount field as unique",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100074",
"datePublished": "2026-09-25T13:06:46.777Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100073 (GCVE-0-2026-100073)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
ext4: fix transaction overflow during writeback
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix transaction overflow during writeback
Commit 95ad8ee45cdb ("ext4: correct the reserved credits for extent
conversion") was correct to note that we need to reserve enough credits
for all extents possibly underlying a large folio. However it was too
eager to reduce the number of reserved credits. Extent conversion may
not only need to touch several leaf extent blocks, it may also need to
split extents - for example a single large unwritten extent may need to
be split into many small written ones in case of sparse folio dirtying.
This can thus result not only in extent leaf modifications but also in a
need to allocate new extent tree nodes. As a result the reserved
transaction credits were not sufficient in some corner cases. Use
ext4_meta_trans_blocks() for correct upper bound credit estimate.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
95ad8ee45cdbc321c135a2db895d48b374ef0f87 , < a22464c5df5827e884a5a7d3d8fb03870e5bb6c8
(git)
Affected: 95ad8ee45cdbc321c135a2db895d48b374ef0f87 , < 46e8e31771f4f1c5e1cdec37a889a6730e42e9f1 (git) Affected: 2b6d39229bc783198222cddd31e2fbded93c8db7 (git) Affected: 6.16.3 , < 6.17 (semver) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a22464c5df5827e884a5a7d3d8fb03870e5bb6c8",
"status": "affected",
"version": "95ad8ee45cdbc321c135a2db895d48b374ef0f87",
"versionType": "git"
},
{
"lessThan": "46e8e31771f4f1c5e1cdec37a889a6730e42e9f1",
"status": "affected",
"version": "95ad8ee45cdbc321c135a2db895d48b374ef0f87",
"versionType": "git"
},
{
"status": "affected",
"version": "2b6d39229bc783198222cddd31e2fbded93c8db7",
"versionType": "git"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix transaction overflow during writeback\n\nCommit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent\nconversion\") was correct to note that we need to reserve enough credits\nfor all extents possibly underlying a large folio. However it was too\neager to reduce the number of reserved credits. Extent conversion may\nnot only need to touch several leaf extent blocks, it may also need to\nsplit extents - for example a single large unwritten extent may need to\nbe split into many small written ones in case of sparse folio dirtying.\nThis can thus result not only in extent leaf modifications but also in a\nneed to allocate new extent tree nodes. As a result the reserved\ntransaction credits were not sufficient in some corner cases. Use\next4_meta_trans_blocks() for correct upper bound credit estimate."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a22464c5df5827e884a5a7d3d8fb03870e5bb6c8"
},
{
"url": "https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"
}
],
"title": "ext4: fix transaction overflow during writeback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100073",
"datePublished": "2026-09-25T13:06:46.185Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100072 (GCVE-0-2026-100072)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
ACPI: platform: Use acpi_bus_get_primary_device()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: platform: Use acpi_bus_get_primary_device()
The acpi_get_first_physical_node() usage in acpi_platform_fill_resource()
and acpi_create_platform_device() is generally unsafe because in theory
the device returned by it may be freed at any time [1].
It is also inefficient because acpi_get_first_physical_node() is called
multiple times for the same argument which can be avoided.
Address these issues by using acpi_bus_get_primary_device() instead of
acpi_get_first_physical_node() and adjusting the code to call it just
once at the beginning of and acpi_create_platform_device() and drop
the device reference acquired by it upon the return from that function.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3b95bd160547f56a68aeb972c33ae9511e7a8380 , < c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71
(git)
Affected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 , < a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
},
{
"lessThan": "a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:45.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"
},
{
"url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"
}
],
"title": "ACPI: platform: Use acpi_bus_get_primary_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100072",
"datePublished": "2026-09-25T13:06:45.579Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:45.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100071 (GCVE-0-2026-100071)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
net: hsr: free learned nodes on device setup failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: free learned nodes on device setup failure
hsr_dev_finalize() can fail after a lower-device RX handler has
already been registered (slave A is added before the failable slave B
and interlink adds). RX handlers run in softirq regardless of the
master's state, so frames received in that window can learn dynamic
nodes into node_db, and the error unwind never releases them.
Free both owned dynamic databases in the unwind, mirroring
hsr_dellink(). proxy_node_db is provably empty on every current error
exit (only interlink RX feeds it, and the interlink add is the last
failable step) and is freed for symmetry. The order is safe:
hsr_del_port() unregisters each RX handler with synchronize_net()
before hsr_del_nodes() runs, which removes remaining entries with
list_del_rcu() and defers their release with call_rcu() for readers
already under RCU.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < e691eee886871b933d772ffc76d66c80b4c0a25e
(git)
Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 0a340ffd96943a49a78e367efac9517ca767d99b (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < f7289e3492f2694dccd3d79287e0e31879b58650 (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 65702339b3e9fd792f65d4b740928798194d86ce (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 49b01f2939abc676a6f9a118f07a10110ee5f683 (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 7f16289b91eb316f170a6bd22d32e6c632f6a5b6 (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e691eee886871b933d772ffc76d66c80b4c0a25e",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "0a340ffd96943a49a78e367efac9517ca767d99b",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "f7289e3492f2694dccd3d79287e0e31879b58650",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "65702339b3e9fd792f65d4b740928798194d86ce",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "49b01f2939abc676a6f9a118f07a10110ee5f683",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "7f16289b91eb316f170a6bd22d32e6c632f6a5b6",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster\u0027s state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:44.956Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"
},
{
"url": "https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"
},
{
"url": "https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"
},
{
"url": "https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"
},
{
"url": "https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"
},
{
"url": "https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"
}
],
"title": "net: hsr: free learned nodes on device setup failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100071",
"datePublished": "2026-09-25T13:06:44.956Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:44.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100070 (GCVE-0-2026-100070)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
sashiko says:
If map_addr() changes the packet length, such as when the public NAT IP
string is shorter or longer than the internal IP, coff will still point to
the offset relative to the pre-mangled packet.
If the packet shrinks, coff could overshoot the correct position,
potentially causing the next ct_sip_parse_header_uri() call to silently
skip bytes and miss subsequent Contact headers. Could this lead to a
failure to NAT those subsequent headers and leak internal network details?
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c978cd3a937141deaf7995b849824af6dacdeae7 , < 6828aca3d82717c2fda92af81c0dda642bc2b465
(git)
Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 2703f5ea8d85bc729f433ac09ee902084c947122 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 0f4d30e2e49f343fc28ba1e259fd22969b940c46 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 810da5a63549531da78348b0a4545042d84e01e2 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 668cc1c30caedc63070b10d17d5514748988a140 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < e70d48fcf8382581162608a4a322919bfd22aef3 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < c408d416618ebb8a95e3097a13f3b793ea9272ee (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 16aecbe3036f6097c26b51b12e4c1cf207769690 (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6828aca3d82717c2fda92af81c0dda642bc2b465",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "2703f5ea8d85bc729f433ac09ee902084c947122",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "0f4d30e2e49f343fc28ba1e259fd22969b940c46",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "810da5a63549531da78348b0a4545042d84e01e2",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "668cc1c30caedc63070b10d17d5514748988a140",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "e70d48fcf8382581162608a4a322919bfd22aef3",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "c408d416618ebb8a95e3097a13f3b793ea9272ee",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "16aecbe3036f6097c26b51b12e4c1cf207769690",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: rewind offset when NAT shrinks the packet\n\nsashiko says:\n If map_addr() changes the packet length, such as when the public NAT IP\n string is shorter or longer than the internal IP, coff will still point to\n the offset relative to the pre-mangled packet.\n If the packet shrinks, coff could overshoot the correct position,\n potentially causing the next ct_sip_parse_header_uri() call to silently\n skip bytes and miss subsequent Contact headers. Could this lead to a\n failure to NAT those subsequent headers and leak internal network details?"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:44.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6828aca3d82717c2fda92af81c0dda642bc2b465"
},
{
"url": "https://git.kernel.org/stable/c/2703f5ea8d85bc729f433ac09ee902084c947122"
},
{
"url": "https://git.kernel.org/stable/c/0f4d30e2e49f343fc28ba1e259fd22969b940c46"
},
{
"url": "https://git.kernel.org/stable/c/810da5a63549531da78348b0a4545042d84e01e2"
},
{
"url": "https://git.kernel.org/stable/c/668cc1c30caedc63070b10d17d5514748988a140"
},
{
"url": "https://git.kernel.org/stable/c/e70d48fcf8382581162608a4a322919bfd22aef3"
},
{
"url": "https://git.kernel.org/stable/c/c408d416618ebb8a95e3097a13f3b793ea9272ee"
},
{
"url": "https://git.kernel.org/stable/c/16aecbe3036f6097c26b51b12e4c1cf207769690"
}
],
"title": "netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100070",
"datePublished": "2026-09-25T13:06:44.311Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:44.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}