Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
37334 vulnerabilities by linux
CVE-2026-74733 (GCVE-0-2026-74733)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
Locking is disabled in the regmap config as this driver uses its own
lock. This means that all calls to regmap functions (read or write) must
hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do
this, and it was therefore possible that multiple threads could cause an
incorrect register to be read/written.
A previous patch partly fixed this, but only protected the write to the
interrupt mask register, and not the read from the direction register.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bfc6444b57dc7186b6acc964705d7516cbaf3904 , < e6a2f5f845f50b0c4299bace5111f56d3390a090
(git)
Affected: bfc6444b57dc7186b6acc964705d7516cbaf3904 , < 9dc325327babe7f159e84cbe9380a45342da0585 (git) Affected: 58a5c93bd1a6e949267400080f07e57ffe05ec34 (git) Affected: e2ecdddca80dd845df42376e4b0197fe97018ba2 (git) Affected: de7cffa53149c7b48bd1bb29b02390c9f05b7f41 (git) Affected: 6.1.101 , < 6.2 (semver) Affected: 6.6.42 , < 6.7 (semver) Affected: 6.9.11 , < 6.10 (semver) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-pca953x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090",
"status": "affected",
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"versionType": "git"
},
{
"lessThan": "9dc325327babe7f159e84cbe9380a45342da0585",
"status": "affected",
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"versionType": "git"
},
{
"status": "affected",
"version": "58a5c93bd1a6e949267400080f07e57ffe05ec34",
"versionType": "git"
},
{
"status": "affected",
"version": "e2ecdddca80dd845df42376e4b0197fe97018ba2",
"versionType": "git"
},
{
"status": "affected",
"version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.101",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.42",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-pca953x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable pca953x_irq_bus_sync_unlock() path is reached only through local kernel interfaces\u2014GPIO chardev ioctls (GPIO_V2_GET_LINE_IOCTL, GPIO_V2_LINE_SET_CONFIG_IOCTL, GPIO_V2_LINE_SET_VALUES_IOCTL), legacy sysfs GPIO, or concurrent in-kernel GPIO/IRQ ops\u2014not via any network or physical bus-facing attack surface.\nAC:L - An attacker drives both racing sides directly: one thread loops IRQ edge-detection setup/teardown (request_irq \u2192 irq_bus_sync_unlock) while another hammers GPIO value/direction writes holding i2c_lock; the original report reproduced the race ~1 in 1000 boots, so deliberate concurrency wins reliably.\nPR:L - Exploitation requires an open file descriptor on /dev/gpiochipN or sysfs GPIO access; on embedded, industrial, medical, and automotive boards using pca953x expanders, udev routinely grants gpio group membership to unprivileged local users.\nUI:N - No victim interaction is required\u2014the attacker performs all GPIO ioctl and IRQ configuration steps in its own threads without needing another user to mount, open, or configure devices.\nS:U - Corruption is confined to the kernel and the same on-board I2C GPIO expander; it does not cross VM, container, IOMMU, or other security-boundary scopes into a different authority.\nC:H - With regmap disable_locking=true, the unprotected pca953x_read_regs() direction read races locked regmap paths, corrupting the maple regcache and returning data from the wrong register\u2014yielding kernel heap UAF read and unintended register-state disclosure.\nI:H - Racing regmap transactions write interrupt-latch/direction data into wrong expander registers (documented output-register corruption), arbitrarily toggling safety-critical GPIO outputs; concurrent unsynchronized regcache writes provide a heap corruption/write primitive.\nA:H - Concurrent regcache maple-tree corruption from unsynchronized regmap access can trigger kernel oops/panic via double-free; miswritten interrupt masks or direction registers can wedge expander IRQ handling and GPIO consumers in a persistent denial-of-service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:11.965Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"
},
{
"url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"
}
],
"title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74733",
"datePublished": "2026-08-22T15:33:21.579Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-08-25T05:42:11.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74732 (GCVE-0-2026-74732)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
drm/amd/display: Check for tg ops in dce110_set_avmute
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Check for tg ops in dce110_set_avmute
Some older DCE timing generators do not implement is_tg_enabled in
their ops table. Calling it unconditionally when waiting for AV mute
frames causes a NULL pointer dereference on Southern Islands dGPUs
when turning the display off over HDMI.
Check that tg and the required ops exist before waiting for frames.
(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 853c2d31408bd45dcf92d0eb1f06eb439a56cf04
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d089f32d34f821c8f0ef23d5fcd77bd43c1b3b92 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5edbb409b0bc5001195f4b7cfca19122361211a1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3141e3d61469bba2624a91c5e2407f110b33b29e (git) Affected: 0 , < 6.12.104 (semver) Affected: 0 , < 6.18.45 (semver) Affected: 0 , < 7.1.9 (semver) |
|
| Linux | Linux |
Unaffected:
6.12.104 , ≤ 6.12.*
(semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "853c2d31408bd45dcf92d0eb1f06eb439a56cf04",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d089f32d34f821c8f0ef23d5fcd77bd43c1b3b92",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5edbb409b0bc5001195f4b7cfca19122361211a1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3141e3d61469bba2624a91c5e2407f110b33b29e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.12.104",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.45",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check for tg ops in dce110_set_avmute\n\nSome older DCE timing generators do not implement is_tg_enabled in\ntheir ops table. Calling it unconditionally when waiting for AV mute\nframes causes a NULL pointer dereference on Southern Islands dGPUs\nwhen turning the display off over HDMI.\n\nCheck that tg and the required ops exist before waiting for frames.\n\n(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:20.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/853c2d31408bd45dcf92d0eb1f06eb439a56cf04"
},
{
"url": "https://git.kernel.org/stable/c/d089f32d34f821c8f0ef23d5fcd77bd43c1b3b92"
},
{
"url": "https://git.kernel.org/stable/c/5edbb409b0bc5001195f4b7cfca19122361211a1"
},
{
"url": "https://git.kernel.org/stable/c/3141e3d61469bba2624a91c5e2407f110b33b29e"
}
],
"title": "drm/amd/display: Check for tg ops in dce110_set_avmute",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74732",
"datePublished": "2026-08-22T15:33:20.934Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-08-22T15:33:20.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74731 (GCVE-0-2026-74731)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
A sub-scheduler enable can fail before scx_link_sched() links the sched into
the hierarchy, e.g. when the parent is already being disabled, and cleanup
still runs the full scx_sub_disable().
That is racy against root disable: drain_descendants() is the only ordering
between a sub's disable-time task walk and root disable's all-task teardown,
and an unlinked sub is invisible to it. Root's teardown can thus run between
the never-linked sub's drain and its walk, exiting every task to no
scheduler.
The walk then trips the membership WARN and re-homes the exited tasks onto
the dying hierarchy, a use-after-free.
Skip the cgroup ownership reset and the task walk if @sch was never linked,
indicated by the empty ->sibling as unlinking only happens later in the same
function. The membership WARN remains valid: a linked sub is always waited
on by an ancestor's drain.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
337ec00b1d9c676f637651c2cefddb8612b867ee , < 6428093a4a986c38c9089b5eb32b56d914ef437a
(git)
Affected: 337ec00b1d9c676f637651c2cefddb8612b867ee , < 8c13364db9c9a43ed286f3a8d0fb9477b1adc43c (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6428093a4a986c38c9089b5eb32b56d914ef437a",
"status": "affected",
"version": "337ec00b1d9c676f637651c2cefddb8612b867ee",
"versionType": "git"
},
{
"lessThan": "8c13364db9c9a43ed286f3a8d0fb9477b1adc43c",
"status": "affected",
"version": "337ec00b1d9c676f637651c2cefddb8612b867ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Skip sub-disable teardown for never-linked sub-schedulers\n\nA sub-scheduler enable can fail before scx_link_sched() links the sched into\nthe hierarchy, e.g. when the parent is already being disabled, and cleanup\nstill runs the full scx_sub_disable().\n\nThat is racy against root disable: drain_descendants() is the only ordering\nbetween a sub\u0027s disable-time task walk and root disable\u0027s all-task teardown,\nand an unlinked sub is invisible to it. Root\u0027s teardown can thus run between\nthe never-linked sub\u0027s drain and its walk, exiting every task to no\nscheduler.\n\nThe walk then trips the membership WARN and re-homes the exited tasks onto\nthe dying hierarchy, a use-after-free.\n\nSkip the cgroup ownership reset and the task walk if @sch was never linked,\nindicated by the empty -\u003esibling as unlinking only happens later in the same\nfunction. The membership WARN remains valid: a linked sub is always waited\non by an ancestor\u0027s drain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local bpf(2) syscalls (BPF_MAP_CREATE/UPDATE_ELEM, BPF_PROG_LOAD, BPF_LINK_CREATE) that register sched_ext_ops struct_ops and invoke scx_enable()/scx_sub_enable_workfn(); per kernel CNA guidance BPF/sched_ext is Local, not network-reachable.\nAC:L - The attacker controls both sides of the race by concurrently attaching a sub-scheduler and closing the root BPF link to trigger scx_root_disable() while never-linked sub cleanup runs scx_sub_disable(); repeated attempts can reliably hit the window between drain_descendants() and the task walk.\nPR:L - Exploitation requires CAP_BPF to create BPF_MAP_TYPE_STRUCT_OPS, load BPF_PROG_TYPE_STRUCT_OPS, and BPF_LINK_CREATE sched_ext; per kernel guidance this is Low because CAP_BPF is obtainable via user namespaces/BPF tokens, not init-namespace root only.\nUI:N - No victim interaction is required; the attacker loads root and sub BPF schedulers, targets their cgroup, and closes BPF links from their own processes to orchestrate the concurrent enable-failure and teardown race.\nS:U - The use-after-free corrupts kernel scheduler/task state during sched_ext teardown on the same host kernel; this is standard kernel memory corruption and privilege escalation impact, not a VM escape or cross-security-authority boundary.\nC:H - Failed never-linked sub cleanup re-homes tasks onto a dying scx_sched hierarchy after root disable frees scheduler state; this use-after-free on scheduler/task metadata can be leveraged for arbitrary kernel memory disclosure per kernel UAF guidance.\nI:H - The UAF during scx_set_task_sched()/scx_enable_task() on a freed scx_sched corrupts scheduler pointers and task ownership in the system-wide scheduler path, enabling heap corruption and arbitrary kernel write or code execution primitives.\nA:H - The race re-homes tasks onto a tearing-down sched_ext hierarchy, tripping membership WARNs and corrupting scheduler teardown; this causes kernel oops/panic/hang on a system-wide scheduler subsystem, which is High availability impact per kernel guidance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:10.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6428093a4a986c38c9089b5eb32b56d914ef437a"
},
{
"url": "https://git.kernel.org/stable/c/8c13364db9c9a43ed286f3a8d0fb9477b1adc43c"
}
],
"title": "sched_ext: Skip sub-disable teardown for never-linked sub-schedulers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74731",
"datePublished": "2026-08-22T15:33:20.294Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-08-25T05:42:10.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74730 (GCVE-0-2026-74730)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < ed2f92ce2fc48463c41e0e540b9a3454889e8af8
(git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < d858ab09e787106432d4d9830bad9dfedf02f890 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < af62f1af182d33a0de38308c012841885d8ab92e (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < ed1161ab6239761958b38d5667225634fc2be894 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < d71dfffa512e71b166a889484e4c3b148a9a3af2 (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd (git) Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < cf616096a0f3a2b60f7d68b6b39674a6867ded9c (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/nfs4proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed2f92ce2fc48463c41e0e540b9a3454889e8af8",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "d858ab09e787106432d4d9830bad9dfedf02f890",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "af62f1af182d33a0de38308c012841885d8ab92e",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "ed1161ab6239761958b38d5667225634fc2be894",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "d71dfffa512e71b166a889484e4c3b148a9a3af2",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "80ed3d762628b36c9e4b22fac7c65b72ef3b13dd",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
},
{
"lessThan": "cf616096a0f3a2b60f7d68b6b39674a6867ded9c",
"status": "affected",
"version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/nfs4proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\n\nDan Aloni reports that he was able to hit a use-after-free bug if a\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\nwhile operations are still in flight."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the NFSv4 client FREE_STATEID path: nfs41_free_stateid_prepare/done/release use a freed struct nfs_server while handling async RPC completions driven by NFSv4 replies from the mounted server and by server-initiated CB_RECALL/CB_RECALLANY callbacks on the NFS backchannel.\nAC:L - The attacker controls both sides of the race: they provoke FREE_STATEID via revocation responses or callbacks, keep it in flight with NFS4ERR_DELAY, and time nfs_server teardown via user-mount umount, automount idle expiry, or the concurrent stateid cleanup that runs during umount itself.\nPR:N - A malicious or compromised NFSv4 server needs no account or elevated capability on the victim client once an NFSv4.1+ mount exists; FREE_STATEID is issued automatically during server-driven stateid revocation handling without any client-side privileges at exploit time.\nUI:N - After an NFS mount exists (boot-time, autofs, or Kubernetes volumes are common), no further victim action is needed: the attacker drives recall/revocation on the wire and mount teardown follows from automated autofs expiry or attacker-controlled umount on a user-mounted export.\nS:U - The use-after-free corrupts kernel heap within the NFS client on the same host; it is a standard kernel memory-safety bug, not a VM escape, container breakout, or IOMMU/DMA boundary crossing.\nC:H - Freed struct nfs_server objects are kmalloc\u0027d and callbacks dereference nfs_client, rpc_clnt, and super_block fields after nfs_free_server/call_rcu, giving a classic UAF read primitive over attacker-influenced heap contents including function pointers.\nI:H - UAF on struct nfs_server exposes destroy hooks, RPC client handles, and client/session state pointers that an attacker can reschedule via heap grooming, yielding write and control-flow primitives typical of NFS client heap corruption bugs.\nA:H - Use of a freed nfs_server in RPC prepare/done/release paths causes kernel oops or panic; Dan Aloni demonstrated reliable reproduction, and UAFs in this path crash hosts even when not fully weaponized."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:09.527Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8"
},
{
"url": "https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890"
},
{
"url": "https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e"
},
{
"url": "https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd"
},
{
"url": "https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894"
},
{
"url": "https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2"
},
{
"url": "https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd"
},
{
"url": "https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c"
}
],
"title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74730",
"datePublished": "2026-08-22T15:33:19.659Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-08-25T05:42:09.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74729 (GCVE-0-2026-74729)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
put_fifo_with_discard() acts as both producer and consumer on the kfifo:
it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from
the IRQ handler without synchronizing with snoop_file_read(), which also
consumes via kfifo_to_user(). On SMP systems this concurrent access can
leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp
to (in - out) is ineffective and kfifo_copy_to_user() can attempt a
copy_to_user() past the kmalloc-2k backing store:
usercopy: Kernel memory exposure attempt detected from SLUB object
'kmalloc-2k' (offset 0, size 2049)!
kernel BUG at mm/usercopy.c!
Call trace:
usercopy_abort
__check_heap_object
__check_object_size
kfifo_copy_to_user
__kfifo_to_user
snoop_file_read
vfs_read
Serialize kfifo access with a per-channel spinlock shared between the
IRQ handler (producer) and the file reader (consumer). Annotate @fifo
with __guarded_by(&lock) and opt the driver into context analysis so the
compiler enforces that all fifo access holds the lock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3772e5da445420543b25825ac2b5971f3743f6e8 , < 131ab677b03349a5ae48da8722ec7075b37ec66e
(git)
Affected: 3772e5da445420543b25825ac2b5971f3743f6e8 , < 1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/aspeed/Makefile",
"drivers/soc/aspeed/aspeed-lpc-snoop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "131ab677b03349a5ae48da8722ec7075b37ec66e",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
},
{
"lessThan": "1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/aspeed/Makefile",
"drivers/soc/aspeed/aspeed-lpc-snoop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read\n\nput_fifo_with_discard() acts as both producer and consumer on the kfifo:\nit calls kfifo_skip() (advances out) and kfifo_put() (advances in) from\nthe IRQ handler without synchronizing with snoop_file_read(), which also\nconsumes via kfifo_to_user(). On SMP systems this concurrent access can\nleave (in - out) larger than the ring buffer, so __kfifo_to_user()\u0027s clamp\nto (in - out) is ineffective and kfifo_copy_to_user() can attempt a\ncopy_to_user() past the kmalloc-2k backing store:\n\n usercopy: Kernel memory exposure attempt detected from SLUB object\n \u0027kmalloc-2k\u0027 (offset 0, size 2049)!\n kernel BUG at mm/usercopy.c!\n Call trace:\n usercopy_abort\n __check_heap_object\n __check_object_size\n kfifo_copy_to_user\n __kfifo_to_user\n snoop_file_read\n vfs_read\n\nSerialize kfifo access with a per-channel spinlock shared between the\nIRQ handler (producer) and the file reader (consumer). Annotate @fifo\nwith __guarded_by(\u0026lock) and opt the driver into context analysis so the\ncompiler enforces that all fifo access holds the lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:19.037Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/131ab677b03349a5ae48da8722ec7075b37ec66e"
},
{
"url": "https://git.kernel.org/stable/c/1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f"
}
],
"title": "soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74729",
"datePublished": "2026-08-22T15:33:19.037Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:19.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74728 (GCVE-0-2026-74728)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
xfs: handle NULL b_addr in xfs_buf_free
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: handle NULL b_addr in xfs_buf_free
When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
bp->b_addr still NULL. The code falls through to the folio_put path
which calls virt_to_folio(NULL), dereferencing an invalid address and
causing a kernel crash.
Call Trace:
xfs_buf_free+0x25f/0x510
xfs_buf_alloc+0xc98/0x19b0
xfs_buf_find_insert+0x55/0x14d0
xfs_buf_get_map+0x122b/0x17c0
xfbtree_init_leaf_block+0x11c/0x4a0
xfbtree_init+0x1bb/0x460
xrep_rmap_setup_scan+0x100/0x1f0
xrep_rmapbt+0x41/0xc0
Fix this by skipping folio_put() when bp->b_addr is NULL.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5076a6040ca1613e616d84aecfaac5f932db84e0 , < ccf6738adcafa5ddbddc4e71b45d8a51b86643c7
(git)
Affected: 5076a6040ca1613e616d84aecfaac5f932db84e0 , < 3aa0c1d23ee1b9d9b340fb2f4736536e1408d706 (git) Affected: 5076a6040ca1613e616d84aecfaac5f932db84e0 , < d852729c5f4f830fbe7413df032e29459b3daf83 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ccf6738adcafa5ddbddc4e71b45d8a51b86643c7",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
},
{
"lessThan": "3aa0c1d23ee1b9d9b340fb2f4736536e1408d706",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
},
{
"lessThan": "d852729c5f4f830fbe7413df032e29459b3daf83",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: handle NULL b_addr in xfs_buf_free\n\nWhen xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with\nbp-\u003eb_addr still NULL. The code falls through to the folio_put path\nwhich calls virt_to_folio(NULL), dereferencing an invalid address and\ncausing a kernel crash.\n\n Call Trace:\n xfs_buf_free+0x25f/0x510\n xfs_buf_alloc+0xc98/0x19b0\n xfs_buf_find_insert+0x55/0x14d0\n xfs_buf_get_map+0x122b/0x17c0\n xfbtree_init_leaf_block+0x11c/0x4a0\n xfbtree_init+0x1bb/0x460\n xrep_rmap_setup_scan+0x100/0x1f0\n xrep_rmapbt+0x41/0xc0\n\nFix this by skipping folio_put() when bp-\u003eb_addr is NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:18.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ccf6738adcafa5ddbddc4e71b45d8a51b86643c7"
},
{
"url": "https://git.kernel.org/stable/c/3aa0c1d23ee1b9d9b340fb2f4736536e1408d706"
},
{
"url": "https://git.kernel.org/stable/c/d852729c5f4f830fbe7413df032e29459b3daf83"
}
],
"title": "xfs: handle NULL b_addr in xfs_buf_free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74728",
"datePublished": "2026-08-22T15:33:18.412Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:18.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74727 (GCVE-0-2026-74727)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
ovpn: skip rehash for peers already removed from by_id
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovpn: skip rehash for peers already removed from by_id
ovpn_nl_peer_set_doit() resolves the target peer via
ovpn_peer_get_by_id() before taking ovpn->lock. In the window between
the lookup (which only takes a refcount) and the subsequent
spin_lock_bh(&ovpn->lock), a concurrent OVPN_CMD_PEER_DEL, keepalive
expiry, or socket teardown can take ovpn->lock first, run
ovpn_peer_remove() to unhash the peer from all four tables (by_id,
by_vpn_addr4/6, by_transp_addr) and release the lock. set_doit then
acquires ovpn->lock and calls ovpn_peer_hash_vpn_ip(), which
re-inserts the now-removed peer back into the rehashing tables.
The same race affects the float path: ovpn_peer_endpoints_update()
holds only a refcount and acquires ovpn->lock very late (after async
AEAD decrypt and a netlink notification), then rehashes the peer
in the by_transp_addr table.
The resurrected peer becomes reachable again from the RX lookup
(ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though
userspace believes it is gone. Once the data-path refcount drops the
peer is freed via call_rcu while the hash entries embedded in it
remain linked, opening a UAF window.
Bail out of the rehash when hash_entry_id is unhashed, mirroring
the sentinel already used by ovpn_peer_remove() to detect the
already-removed state. The check is safe under ovpn->lock, which
serializes every mutation of hash_entry_id, and is a no-op for the
add path because ovpn_peer_add_mp() inserts hash_entry_id before
calling ovpn_peer_hash_vpn_ip().
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1d36a36f6d5347360ef9681a05f6166683bafd1d , < d20c181088984b6eaa8d7fe7cb5ab3510988df59
(git)
Affected: 1d36a36f6d5347360ef9681a05f6166683bafd1d , < 66745480298775f188b2f5ad266643e85a90f73b (git) Affected: 1d36a36f6d5347360ef9681a05f6166683bafd1d , < 33ec10567fe14456063daf549fdf1a4f53448e4c (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/peer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d20c181088984b6eaa8d7fe7cb5ab3510988df59",
"status": "affected",
"version": "1d36a36f6d5347360ef9681a05f6166683bafd1d",
"versionType": "git"
},
{
"lessThan": "66745480298775f188b2f5ad266643e85a90f73b",
"status": "affected",
"version": "1d36a36f6d5347360ef9681a05f6166683bafd1d",
"versionType": "git"
},
{
"lessThan": "33ec10567fe14456063daf549fdf1a4f53448e4c",
"status": "affected",
"version": "1d36a36f6d5347360ef9681a05f6166683bafd1d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/peer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: skip rehash for peers already removed from by_id\n\novpn_nl_peer_set_doit() resolves the target peer via\novpn_peer_get_by_id() before taking ovpn-\u003elock. In the window between\nthe lookup (which only takes a refcount) and the subsequent\nspin_lock_bh(\u0026ovpn-\u003elock), a concurrent OVPN_CMD_PEER_DEL, keepalive\nexpiry, or socket teardown can take ovpn-\u003elock first, run\novpn_peer_remove() to unhash the peer from all four tables (by_id,\nby_vpn_addr4/6, by_transp_addr) and release the lock. set_doit then\nacquires ovpn-\u003elock and calls ovpn_peer_hash_vpn_ip(), which\nre-inserts the now-removed peer back into the rehashing tables.\n\nThe same race affects the float path: ovpn_peer_endpoints_update()\nholds only a refcount and acquires ovpn-\u003elock very late (after async\nAEAD decrypt and a netlink notification), then rehashes the peer\nin the by_transp_addr table.\n\nThe resurrected peer becomes reachable again from the RX lookup\n(ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though\nuserspace believes it is gone. Once the data-path refcount drops the\npeer is freed via call_rcu while the hash entries embedded in it\nremain linked, opening a UAF window.\n\nBail out of the rehash when hash_entry_id is unhashed, mirroring\nthe sentinel already used by ovpn_peer_remove() to detect the\nalready-removed state. The check is safe under ovpn-\u003elock, which\nserializes every mutation of hash_entry_id, and is a no-op for the\nadd path because ovpn_peer_add_mp() inserts hash_entry_id before\ncalling ovpn_peer_hash_vpn_ip()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The float-path UAF is reached from ovpn_udp_encap_recv()/ovpn_tcp_rcv() through ovpn_recv(), async AEAD decrypt, and ovpn_peer_endpoints_update(); a remote peer sends authenticated DATA_V2 packets over UDP/TCP to an internet-facing MP-mode OpenVPN gateway.\nAC:L - The remote peer controls float timing (new transport source), packet rate, and concurrent removal via TCP disconnect, UDP socket teardown, or keepalive expiry; netlink PEER_SET vs PEER_DEL races are likewise attacker-synchronized with no luck-dependent layout.\nPR:N - On an internet-facing MP-mode gateway, exploitation needs no Linux credentials on the victim\u2014only an established kernel-installed peer with valid AEAD keys (or namespace CAP_NET_ADMIN for netlink races), matching a remote VPN client rather than host root.\nUI:N - The rehash race is triggered by normal peer traffic and automatic keepalive/socket teardown; no administrator or end-user action on the victim host is required beyond routine VPN server operation.\nS:U - The UAF corrupts ovpn peer hash tables inside the kernel VPN driver; impact remains within the host kernel security domain without crossing VM, container, or IOMMU boundaries.\nC:H - Freed ovpn_peer objects remain linked in by_transp_addr/by_vpn_addr hash tables, so RX/TX lookups dereference recycled kmalloc-1k structures and enable arbitrary kernel-memory reads via attacker-controlled heap reuse.\nI:H - Resurrected hash entries steer traffic to freed peers and subsequent RCU/kref teardown on stale objects provide typical slab-UAF write primitives (refcount, socket, crypto pointer updates) suitable for kernel code execution.\nA:H - Use-after-free on hot datapath peer lookups reliably causes kernel oops/panic or slab corruption on VPN gateways, and remote peers can repeat the race to sustain denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:08.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d20c181088984b6eaa8d7fe7cb5ab3510988df59"
},
{
"url": "https://git.kernel.org/stable/c/66745480298775f188b2f5ad266643e85a90f73b"
},
{
"url": "https://git.kernel.org/stable/c/33ec10567fe14456063daf549fdf1a4f53448e4c"
}
],
"title": "ovpn: skip rehash for peers already removed from by_id",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74727",
"datePublished": "2026-08-22T15:33:17.773Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:08.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74726 (GCVE-0-2026-74726)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and
takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the
active slave. In that window the active slave can change under RTNL
(RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()),
which already drops the promiscuity and clears primary_is_promisc. The
monitor still acts on the stale decision: if the slave was removed with no
failover, curr_active_slave is now NULL and the deref faults; if it failed
over, the stale dev_set_promiscuity(-1) underflows the new slave's
promiscuity counter and pins it in IFF_PROMISC.
Oops: general protection fault, probably for non-canonical address ...
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: b42 bond_alb_monitor
RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
Kernel panic - not syncing: Fatal exception
Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so
the monitor only undoes an increment it still owns. The other bonding
monitors already re-read state under RTNL in their commit phase
(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only
one acting on the pre-trylock decision.
Severity
7.3 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d0e81b7e2246a41d068ecaf15aac9de570816d63 , < f7668762bf5fd6db9397de5c0514407489d9d815
(git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 09add8d5cfa9c46828f51eaad162c36e86366b71 (git) Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < b82f51681a7a88c7d3c865e817a3340d42b5fa2a (git) Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < dd148539fb4741d01c06b7d2c8bd84b01920756c (git) Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < dccec0227ed8d9e36936d66e256b957dc2858468 (git) Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 2faf75a8a06504071b4c0aea7e45a9cc49a4e187 (git) Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2 (git) Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d (git) |
|
| Linux | Linux |
Affected:
2.6.24
Unaffected: 0 , < 2.6.24 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_alb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_alb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -\u003e __bond_release_one() -\u003e bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave\u0027s\npromiscuity counter and pins it in IFF_PROMISC.\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n Workqueue: b42 bond_alb_monitor\n RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n process_one_work (kernel/workqueue.c:3322)\n worker_thread (kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local RTNL netlink (RTM_DELLINK) or bonding ioctl (SIOCBONDRELEASE) to remove/reconfigure slaves while bond_alb_monitor runs; the bug is in a delayed workqueue, not in packet receive or any remote network protocol path.\nAC:L - An attacker with CAP_NET_ADMIN controls both race sides\u2014timing slave removal/failover against the periodic ALB monitor after primary_is_promisc is set\u2014and can retry rapidly when rtnl_trylock fails, making NULL deref or promiscuity-counter underflow reliably winnable.\nPR:L - Triggering ALB bond setup and slave release requires CAP_NET_ADMIN, which unprivileged users can obtain inside a user+network namespace (unshare -Urn), enabling host-wide kernel panic without init-namespace root on typical distributions.\nUI:N - No victim interaction is required; the attacker programmatically creates an ALB bond, drives primary_is_promisc via slave disable/removal, and races bond_alb_monitor without any other user or administrator action.\nS:U - Impact is confined to kernel networking state and causes host kernel panic or netdev promiscuity corruption; it does not cross VM, container, or IOMMU security boundaries into another security authority.\nC:H - Beyond the NULL-deref crash path, the failover race underflows dev-\u003epromiscuity and permanently pins IFF_PROMISC on the new active slave, enabling sustained capture of all traffic on that bonded interface/segment\u2014a broad confidentiality impact on server/cloud HA deployments.\nI:L - The stale dev_set_promiscuity(-1) corrupts the netdev promiscuity counter (unsigned underflow to a huge value), improperly modifying kernel network device state even though it does not provide arbitrary memory write or code-execution primitives.\nA:H - If the active slave is removed without failover, the monitor dereferences a NULL curr_active_slave and panics the kernel, as confirmed by KASAN null-ptr-deref and \"Kernel panic - not syncing: Fatal exception\" in the fix commit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:07.173Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
},
{
"url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
},
{
"url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
},
{
"url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
},
{
"url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
},
{
"url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
},
{
"url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
},
{
"url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
}
],
"title": "bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74726",
"datePublished": "2026-08-22T15:33:17.128Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:07.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74725 (GCVE-0-2026-74725)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
enic: fix tx_hang_reset use-after-free on device removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
enic: fix tx_hang_reset use-after-free on device removal
enic_remove() cancels the reset and change_mtu_work items but does not
cancel tx_hang_reset. A TX timeout that fires while the device is being
removed can schedule enic_tx_hang_reset() so that it runs after
free_netdev(), resulting in a use-after-free.
cancel_work_sync() alone is not sufficient here: the still-live watchdog
and notify paths can re-schedule these work items in the window between
the cancel and unregister_netdev(). Use disable_work_sync(), which
cancels the work and blocks any subsequent schedule_work() from
requeuing it, and apply it to the reset and change_mtu_work items as
well so the same requeue race is closed for all teardown work.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
937317c7c1097aa878a5000e3aab616eb5c590c0 , < 8619865f34fb3b130b567855382a5c4aadd522b9
(git)
Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < e506e704b74748ffd0e1c92a7453ca2a959f832b (git) Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < 4f3464fc6c1f26afc504fd525c574f2bc14c9d42 (git) Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < ec680ea4ba1bca92a767fb7e7869758bfdd886e3 (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:05.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"
},
{
"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"
},
{
"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"
},
{
"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"
}
],
"title": "enic: fix tx_hang_reset use-after-free on device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74725",
"datePublished": "2026-08-22T15:33:16.460Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:05.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74724 (GCVE-0-2026-74724)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Sashiko warns that local attacker can modify the packet
while it is processed by IPVS. Some places read the
IP ihl field multiple times which can cause out-of-bounds
access. One such place is ip_vs_nat_icmp where we
can write after the validated area.
Fix it by providing ciph argument just like it is done for
IPv6 and use ciph->len as offset to the embedded transport
header.
Modify some IPv4 header checks by reading the ihl field
only once.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3b8f79af0e98f27b932b0b416e9c52b692d31ff9
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3c779b258c9c3c3567af68d4f45c2f751f35bd0e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < be65fa324640c7a95e30b146159a2be5cc73f22e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a69a4b3fff5814d079beff9a1e9d369994b2ed47 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 243d0187ec4c3837b9b0004f18d1068e46115760 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 646922a0379496154e8c8faca4f8e2fd9100cacc (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b8f79af0e98f27b932b0b416e9c52b692d31ff9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3c779b258c9c3c3567af68d4f45c2f751f35bd0e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "be65fa324640c7a95e30b146159a2be5cc73f22e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a69a4b3fff5814d079beff9a1e9d369994b2ed47",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "243d0187ec4c3837b9b0004f18d1068e46115760",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "646922a0379496154e8c8faca4f8e2fd9100cacc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: avoid out-of-bounds write in ip_vs_nat_icmp\n\nSashiko warns that local attacker can modify the packet\nwhile it is processed by IPVS. Some places read the\nIP ihl field multiple times which can cause out-of-bounds\naccess. One such place is ip_vs_nat_icmp where we\ncan write after the validated area.\n\nFix it by providing ciph argument just like it is done for\nIPv6 and use ciph-\u003elen as offset to the embedded transport\nheader.\n\nModify some IPv4 header checks by reading the ihl field\nonly once."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The OOB write in ip_vs_nat_icmp() requires a local process to change the embedded IPv4 ihl in skb frags between ip_vs_fill_iph_skb_icmp() validation and the NAT write; remote-only ICMP to IPVS netfilter hooks cannot perform that TOCTOU without local access to the packet buffer.\nAC:L - A local attacker controls both sides of the race by concurrently injecting ICMP errors with TCP/UDP/SCTP payloads matching an IPVS NAT connection and modifying the embedded header ihl in skb frags during softirq processing; no victim-specific state or uncontrollable heap layout is required.\nPR:L - Triggering requires a local account able to race skb frag modification (e.g., via raw/packet sockets with CAP_NET_RAW, obtainable in a user namespace) against IPVS ICMP NAT handling on a host where IPVS is already configured; no init-namespace root is needed.\nUI:N - No victim user interaction is required; exploitation is driven entirely by attacker-controlled local packet injection and concurrent frag modification while IPVS processes ICMP errors on NAT-mode connections through LOCAL_IN, LOCAL_OUT, or FORWARD hooks.\nS:U - The out-of-bounds write corrupts kernel skb memory on the IPVS load-balancer host within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Writing TCP/UDP/SCTP port fields and running ip_send_check() using a re-read inflated ihl corrupts skb data beyond the validated region; out-of-bounds kernel memory corruption is exploitable for information disclosure and heap layout control.\nI:H - The bug is an out-of-bounds write of 16-bit port values (and checksum updates over an attacker-inflated header length) past skb_ensure_writable()\u0027s bound, enabling adjacent kernel memory corruption and potential control-flow hijacking on internet-facing IPVS NAT nodes.\nA:H - Corrupting skb header memory beyond the ensured writable area can cause kernel oops or panic during ICMP NAT mangling; a local attacker can repeatedly trigger the race on kube-proxy IPVS nodes and hardware load balancers running IPVS NAT mode."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:04.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9"
},
{
"url": "https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e"
},
{
"url": "https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e"
},
{
"url": "https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47"
},
{
"url": "https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760"
},
{
"url": "https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc"
}
],
"title": "ipvs: avoid out-of-bounds write in ip_vs_nat_icmp",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74724",
"datePublished": "2026-08-22T15:33:15.832Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:04.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74723 (GCVE-0-2026-74723)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
btrfs: lzo: reject inline extents without valid headers
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: lzo: reject inline extents without valid headers
[BUG]
For a crafted btrfs image, the following KASAN can be triggered when
reading an inline lzo compressed file extent:
BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700
Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77
Call Trace:
<TASK>
dump_stack_lvl+0x5b/0x70
print_report+0xd1/0x610
kasan_report+0xe0/0x110
__asan_report_load_n_noabort+0x13/0x20
lzo_decompress+0x57d/0x700
btrfs_decompress+0x140/0x1c0
uncompress_inline+0x147/0x1b0
btrfs_get_extent+0xb23/0x10a0
btrfs_do_readpage.constprop.0+0x538/0x1ac0
btrfs_readahead+0x32f/0x5f0
read_pages+0x16f/0x850
page_cache_ra_unbounded+0x296/0x490
do_page_cache_ra+0xd9/0x130
page_cache_sync_ra+0x3ee/0x6f0
filemap_get_pages+0x306/0x15c0
filemap_read+0x329/0xd00
btrfs_file_read_iter+0x1f8/0x2b0
vfs_read+0x4ef/0x720
ksys_read+0xf8/0x1d0
__x64_sys_read+0x71/0xb0
x64_sys_call+0x1ab0/0x1b70
do_syscall_64+0x61/0x470
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
[CAUSE]
For an inline lzo compressed file extent, there should always be one lzo
header, recording the total length of the compressed data, followed by
one segment header, recording the compressed lzo payload.
But if a crafted inline lzo compressed file extent contains only an lzo
header, without the segment header or payload, lzo_decompress() will
still try to read the segment header, causing a read beyond the item
boundary.
Furthermore if the inline lzo compressed file extent is the first item
of the leaf, it will be at the extent buffer boundary. The above
out-of-boundary read will go beyond the extent buffer boundary,
triggering the above KASAN report.
[FIX]
Validate the total length of the inlined lzo compressed file extent, to
make sure there is at least one LZO header and one segment header, and a
non-zero payload.
[ Rework the commit message to remove slop ]
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a6fa6fae40ec336c7df6155255ae64ebef43a8bc , < fc50b475ad27f50b4dcc98fc4c44e8802bc1b248
(git)
Affected: a6fa6fae40ec336c7df6155255ae64ebef43a8bc , < 0fa78ef637deb5dbe341582f88553a4bce496de0 (git) |
|
| Linux | Linux |
Affected:
2.6.38
Unaffected: 0 , < 2.6.38 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc50b475ad27f50b4dcc98fc4c44e8802bc1b248",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
},
{
"lessThan": "0fa78ef637deb5dbe341582f88553a4bce496de0",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lzo: reject inline extents without valid headers\n\n[BUG]\nFor a crafted btrfs image, the following KASAN can be triggered when\nreading an inline lzo compressed file extent:\n\n BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700\n Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77\n\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5b/0x70\n print_report+0xd1/0x610\n kasan_report+0xe0/0x110\n __asan_report_load_n_noabort+0x13/0x20\n lzo_decompress+0x57d/0x700\n btrfs_decompress+0x140/0x1c0\n uncompress_inline+0x147/0x1b0\n btrfs_get_extent+0xb23/0x10a0\n btrfs_do_readpage.constprop.0+0x538/0x1ac0\n btrfs_readahead+0x32f/0x5f0\n read_pages+0x16f/0x850\n page_cache_ra_unbounded+0x296/0x490\n do_page_cache_ra+0xd9/0x130\n page_cache_sync_ra+0x3ee/0x6f0\n filemap_get_pages+0x306/0x15c0\n filemap_read+0x329/0xd00\n btrfs_file_read_iter+0x1f8/0x2b0\n vfs_read+0x4ef/0x720\n ksys_read+0xf8/0x1d0\n __x64_sys_read+0x71/0xb0\n x64_sys_call+0x1ab0/0x1b70\n do_syscall_64+0x61/0x470\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n\n[CAUSE]\nFor an inline lzo compressed file extent, there should always be one lzo\nheader, recording the total length of the compressed data, followed by\none segment header, recording the compressed lzo payload.\n\nBut if a crafted inline lzo compressed file extent contains only an lzo\nheader, without the segment header or payload, lzo_decompress() will\nstill try to read the segment header, causing a read beyond the item\nboundary.\n\nFurthermore if the inline lzo compressed file extent is the first item\nof the leaf, it will be at the extent buffer boundary. The above\nout-of-boundary read will go beyond the extent buffer boundary,\ntriggering the above KASAN report.\n\n[FIX]\nValidate the total length of the inlined lzo compressed file extent, to\nmake sure there is at least one LZO header and one segment header, and a\nnon-zero payload.\n\n[ Rework the commit message to remove slop ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On storage servers exporting a btrfs volume via nfsd or ksmbd, remote client read I/O reaches uncompress_inline\u2192lzo_decompress on the server kernel; crafted inline LZO extents in a mounted image are parsed without local syscall access.\nAC:L - A btrfs image with an inline LZO extent containing only the 4-byte total header deterministically drives get_unaligned_le32 past the kmalloc copy in lzo_decompress(); tree-checker skips compressed-inline validation so mount succeeds and a normal read triggers the slab OOB.\nPR:N - Triggering requires only read access to exported btrfs content (nfsd/ksmbd read, loop-mount with CAP_SYS_ADMIN in a user namespace, or udisks-assisted mount); creating the malformed metadata needs offline image crafting, not init-namespace root on the victim.\nUI:N - Exploitation is the attacker\u0027s own read against an already-mounted/exported btrfs volume containing the crafted extent; no separate victim must mount media, click a dialog, or perform other interaction beyond the attacker\u0027s read/open.\nS:U - The slab out-of-bounds read and any resulting kernel memory misuse stay within the host kernel security domain; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - get_unaligned_le32 reads up to four bytes past the kmalloc buffer holding the inline extent, leaking adjacent slab contents that can include kernel pointers and enable further kernel memory disclosure.\nI:H - Slab-out-of-bounds access is kernel memory corruption; adjacent kmalloc objects can be groomed and the disclosed pointers chained into arbitrary write or control-flow hijack primitives during repeated reads.\nA:H - KASAN reports slab-out-of-bounds in lzo_decompress on read; the invalid access can fault into adjacent slab objects and oops the kernel, and repeated reads can destabilize or hang the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:03.469Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc50b475ad27f50b4dcc98fc4c44e8802bc1b248"
},
{
"url": "https://git.kernel.org/stable/c/0fa78ef637deb5dbe341582f88553a4bce496de0"
}
],
"title": "btrfs: lzo: reject inline extents without valid headers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74723",
"datePublished": "2026-08-22T15:33:15.196Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:03.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74722 (GCVE-0-2026-74722)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
btrfs: fix memory leak in btrfs_do_encoded_write()
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix memory leak in btrfs_do_encoded_write()
Local fuzzing of 6.12.94 has found the following memory leak:
Unreferenced object 0xffff888018050a80 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601
hex dump (first 32 bytes):
00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................
backtrace (crc a8a6fc29):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]
qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Unreferenced object 0xffff888018050a00 (size 64):
comm "syz.0.17", pid 10297, jiffies 4294953601
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................
90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................
backtrace (crc cb5c9580):
kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
slab_post_alloc_hook mm/slub.c:4152 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114
extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]
__set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086
set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821
qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312
btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355
btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746
btrfs_encoded_write fs/btrfs/file.c:1482 [inline]
btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507
btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738
btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by freeing an extent changeset before returning from
btrfs_do_encoded_write().
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22 , < 0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0
(git)
Affected: 7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22 , < e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47 (git) Affected: 7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22 , < 20c0eeb4313f9f89d47b80b672b5846f9827cb31 (git) Affected: 7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22 , < 24a8f2c29aebb753ccb962fbb25bae18d7978f6e (git) Affected: 7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22 , < 60b50ceba6243802f8d2c0a9a7c2d549a93b1d64 (git) Affected: 7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22 , < d2a4e4e626b2f4670b69b430c357f03f53eb6632 (git) |
|
| Linux | Linux |
Affected:
5.18
Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0",
"status": "affected",
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"versionType": "git"
},
{
"lessThan": "e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47",
"status": "affected",
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"versionType": "git"
},
{
"lessThan": "20c0eeb4313f9f89d47b80b672b5846f9827cb31",
"status": "affected",
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"versionType": "git"
},
{
"lessThan": "24a8f2c29aebb753ccb962fbb25bae18d7978f6e",
"status": "affected",
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"versionType": "git"
},
{
"lessThan": "60b50ceba6243802f8d2c0a9a7c2d549a93b1d64",
"status": "affected",
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"versionType": "git"
},
{
"lessThan": "d2a4e4e626b2f4670b69b430c357f03f53eb6632",
"status": "affected",
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in btrfs_do_encoded_write()\n\nLocal fuzzing of 6.12.94 has found the following memory leak:\n\nUnreferenced object 0xffff888018050a80 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n backtrace (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUnreferenced object 0xffff888018050a00 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n backtrace (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by freeing an extent changeset before returning from\nbtrfs_do_encoded_write()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:14.582Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0"
},
{
"url": "https://git.kernel.org/stable/c/e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47"
},
{
"url": "https://git.kernel.org/stable/c/20c0eeb4313f9f89d47b80b672b5846f9827cb31"
},
{
"url": "https://git.kernel.org/stable/c/24a8f2c29aebb753ccb962fbb25bae18d7978f6e"
},
{
"url": "https://git.kernel.org/stable/c/60b50ceba6243802f8d2c0a9a7c2d549a93b1d64"
},
{
"url": "https://git.kernel.org/stable/c/d2a4e4e626b2f4670b69b430c357f03f53eb6632"
}
],
"title": "btrfs: fix memory leak in btrfs_do_encoded_write()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74722",
"datePublished": "2026-08-22T15:33:14.582Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:14.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74721 (GCVE-0-2026-74721)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma)
before returning an error code to the caller. This is incorrect:
amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling
amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo
that registration. Calling vm_ops->close() manually — which drops the
shmem pages_pin_count and the GEM object reference that backs the VMA —
before the mmap syscall has even returned causes those resources to be
released while the VMA is still alive. The kernel VMA teardown will call
vm_ops->close() a second time when the process later unmaps the range,
producing a reference count underflow.
Replace both hard-error returns with a deferred-fault approach that keeps
the VMA alive and retries page insertion through the HMM range-fault path.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e486147c912f653ef4b60a6c7dbd4168a4c56a9f , < 1501e4d07c6fee0d50531a0d1cb2be01a63e6e75
(git)
Affected: e486147c912f653ef4b60a6c7dbd4168a4c56a9f , < 8d51e0fd3e698919d2adeff71936377f0c0d4aa0 (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1501e4d07c6fee0d50531a0d1cb2be01a63e6e75",
"status": "affected",
"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f",
"versionType": "git"
},
{
"lessThan": "8d51e0fd3e698919d2adeff71936377f0c0d4aa0",
"status": "affected",
"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()\n\nTwo error paths in amdxdna_insert_pages() called vma-\u003evm_ops-\u003eclose(vma)\nbefore returning an error code to the caller. This is incorrect:\namdxdna_gem_obj_mmap() registers an HMM interval notifier before calling\namdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo\nthat registration. Calling vm_ops-\u003eclose() manually \u2014 which drops the\nshmem pages_pin_count and the GEM object reference that backs the VMA \u2014\nbefore the mmap syscall has even returned causes those resources to be\nreleased while the VMA is still alive. The kernel VMA teardown will call\nvm_ops-\u003eclose() a second time when the process later unmaps the range,\nproducing a reference count underflow.\n\nReplace both hard-error returns with a deferred-fault approach that keeps\nthe VMA alive and retries page insertion through the HMM range-fault path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local mmap() on an AMD XDNA GEM buffer through /dev/accel/accel* after DRM_IOCTL_AMDXDNA_CREATE_BO; amdxdna_insert_pages() is only reached from drm_gem_mmap\u2192amdxdna_gem_obj_mmap with no network, adjacent-radio, or physical-bus entry point.\nAC:L - On affected Ryzen AI systems the attacker opens the accel node, creates a buffer, and mmap()s it; vm_insert_pages() or handle_mm_fault() failures are reliably forced via RLIMIT_AS/cgroup memory pressure, deterministically hitting vma-\u003evm_ops-\u003eclose() before failed-mmap VMA teardown invokes close again.\nPR:L - AMDXDNA_CREATE_BO and GEM mmap use ioctl flags 0 (no DRM_ROOT_ONLY/DRM_AUTH); any unprivileged local user allowed to open /dev/accel/accel* (typically render/video group) can reach the bug without real root or init-namespace capabilities.\nUI:N - The attacker opens the accel device, allocates a GEM object, and mmap()s it in their own process; no separate victim mount, file open, or other user interaction beyond the attacker\u0027s own syscalls is required.\nS:U - Premature vma-\u003evm_ops-\u003eclose() double-frees shmem pages_use_count and drm_gem_object references inside kernel DRM/GEM memory management; impact stays within the kernel security authority and is not a VM escape, hypervisor breakout, or IOMMU DMA-boundary bypass.\nC:H - Double close releases backing shmem pages and GEM metadata while the VMA remains live until mmap teardown; refcount underflow creates use-after-free conditions that heap grooming can turn into arbitrary kernel memory disclosure beyond a bounded leak.\nI:H - The erroneous second close corrupts slab/refcount state on freed GEM objects and backing pages, providing primitives developable into arbitrary kernel writes and local privilege escalation rather than merely limited data modification.\nA:H - refcount_t underflow and use-after-free in drm_gem_shmem_vm_close() and drm_gem_object_put() can immediately kernel-oops or panic the host; repeated mmap-trigger attempts sustain denial of service on affected AMD NPU systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:02.244Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1501e4d07c6fee0d50531a0d1cb2be01a63e6e75"
},
{
"url": "https://git.kernel.org/stable/c/8d51e0fd3e698919d2adeff71936377f0c0d4aa0"
}
],
"title": "accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74721",
"datePublished": "2026-08-22T15:33:13.960Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:02.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74720 (GCVE-0-2026-74720)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
EPSS
VEX
Title
bpf: Preserve pointer state for commuted arithmetic
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve pointer state for commuted arithmetic
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.
Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 86b203aadc2930e0a4f9c6277b5b80ff3664c472
(git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 8109c25e0c41f5f19a1c2380bb49c991a877494e (git) Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < d1959028190a7649b926f5867a58de5fe221b23c (git) Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 8cb23101a3fcc7432b451ea3d0f14a90711f4acf (git) Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 29c239f8dbec5ab33a61796724d189bddee6cd4b (git) Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < db6382ed3361bdd8129572a3423956cba1dae829 (git) Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < eaffa1495e4fe6330aeff9f323ea3d48b01f118a (git) Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < a4c6f804b44c5c790269b25e0e61cf4e9f117c86 (git) |
|
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86b203aadc2930e0a4f9c6277b5b80ff3664c472",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "8109c25e0c41f5f19a1c2380bb49c991a877494e",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "d1959028190a7649b926f5867a58de5fe221b23c",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "8cb23101a3fcc7432b451ea3d0f14a90711f4acf",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "29c239f8dbec5ab33a61796724d189bddee6cd4b",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "db6382ed3361bdd8129572a3423956cba1dae829",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "eaffa1495e4fe6330aeff9f323ea3d48b01f118a",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
},
{
"lessThan": "a4c6f804b44c5c790269b25e0e61cf4e9f117c86",
"status": "affected",
"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller\u0027s temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in bpf_check()/adjust_ptr_min_max_vals() during bpf(BPF_PROG_LOAD) via the local bpf(2) syscall; per kernel CNA guidance BPF verifier bugs are Local, not reachable from remote network packet handling.\nAC:L - An attacker fully controls BPF bytecode using commuted 64-bit scalar+=pointer ALU and bpf2bpf call chains, deterministically poisoning register state during verification without races or external preconditions.\nPR:L - Exploitation requires loading bpf2bpf programs (CAP_BPF-gated), which is routinely available to unprivileged users via user namespaces/BPF token delegation or unprivileged socket-filter loading when kernel.unprivileged_bpf_disabled=0, not init-namespace root.\nUI:N - The attacker loads and executes their own crafted BPF program through bpf(2); no separate victim action such as mounting filesystems or opening files is required beyond the attacker\u0027s own local access.\nS:U - Impact is a BPF verifier bypass enabling in-kernel out-of-bounds memory access and privilege escalation within the host kernel\u0027s security authority; it does not cross VM, IOMMU, or sandbox boundaries.\nC:H - Copying only type/id on scalar+=pointer leaves stale frameno, var_off, and map/parent metadata, so bpf_func() stack checks validate the wrong frame and approve out-of-bounds reads of adjacent kernel memory.\nI:H - The same incorrect pointer provenance permits verifier-approved out-of-bounds BPF stack/map writes at runtime, a controllable kernel memory corruption primitive leverageable for arbitrary modification and privilege escalation.\nA:H - Out-of-bounds BPF memory accesses from the bypassed verifier state can corrupt critical kernel data or dereference invalid addresses, reliably causing kernel oops/panic and repeatable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:01.009Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472"
},
{
"url": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e"
},
{
"url": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c"
},
{
"url": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf"
},
{
"url": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b"
},
{
"url": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829"
},
{
"url": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a"
},
{
"url": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86"
}
],
"title": "bpf: Preserve pointer state for commuted arithmetic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74720",
"datePublished": "2026-08-22T15:33:13.342Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:01.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74719 (GCVE-0-2026-74719)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in
smc_llc_event_handler() stores an incoming qentry into the local LLC flow
without first checking whether a qentry is already pending. If a malicious or
buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is
active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the
pointer without freeing the previous allocation, leaking one kmalloc-96 object
per spurious message.
The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry
guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a
duplicate message when qentry is already occupied falls through to break and is
freed by the kfree(qentry) at the out: label, rather than silently leaking the
existing allocation.
The response direction (smc_llc_rx_response()) is unaffected: it already guards
with flow->qentry at the equivalent site and drops duplicate responses
correctly.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < e384f3cba6ea709f5b2272b1770db4ce14047f78
(git)
Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < a1e980d7a9e7ee6faf4f5fd7b450413b969af26d (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < e0eb87677c76b157cdf8eb7c1f19e56227165a33 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < 06734dfeaeba886aab1bf147249195b888ac3e4d (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < c23c409228629107203d3c3e95fff1473173f1a6 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < 10cb31b2b74cb664c6c95cf72364d7d5c483ab82 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < bfc336a9fbbf09805f3dfe25c195a4db90af2846 (git) Affected: 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 , < 976245094925bab9bc39366b2e9ab44ffcde61d0 (git) |
|
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e384f3cba6ea709f5b2272b1770db4ce14047f78",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "a1e980d7a9e7ee6faf4f5fd7b450413b969af26d",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "e0eb87677c76b157cdf8eb7c1f19e56227165a33",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "06734dfeaeba886aab1bf147249195b888ac3e4d",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "c23c409228629107203d3c3e95fff1473173f1a6",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "10cb31b2b74cb664c6c95cf72364d7d5c483ab82",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "bfc336a9fbbf09805f3dfe25c195a4db90af2846",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
},
{
"lessThan": "976245094925bab9bc39366b2e9ab44ffcde61d0",
"status": "affected",
"version": "0fb0b02bd6fd26cba38002be4a6bbcae2228fd44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n\nThe SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in\nsmc_llc_event_handler() stores an incoming qentry into the local LLC flow\nwithout first checking whether a qentry is already pending. If a malicious or\nbuggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is\nactive and flow-\u003eqentry is already set, smc_llc_flow_qentry_set() overwrites the\npointer without freeing the previous allocation, leaking one kmalloc-96 object\nper spurious message.\n\nThe sibling SMC_LLC_DELETE_LINK branch already has the correct !flow-\u003eqentry\nguard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a\nduplicate message when qentry is already occupied falls through to break and is\nfreed by the kfree(qentry) at the out: label, rather than silently leaking the\nexisting allocation.\n\nThe response direction (smc_llc_rx_response()) is unaffected: it already guards\nwith flow-\u003eqentry at the equivalent site and drops duplicate responses\ncorrectly."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:12.716Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e384f3cba6ea709f5b2272b1770db4ce14047f78"
},
{
"url": "https://git.kernel.org/stable/c/a1e980d7a9e7ee6faf4f5fd7b450413b969af26d"
},
{
"url": "https://git.kernel.org/stable/c/e0eb87677c76b157cdf8eb7c1f19e56227165a33"
},
{
"url": "https://git.kernel.org/stable/c/06734dfeaeba886aab1bf147249195b888ac3e4d"
},
{
"url": "https://git.kernel.org/stable/c/c23c409228629107203d3c3e95fff1473173f1a6"
},
{
"url": "https://git.kernel.org/stable/c/10cb31b2b74cb664c6c95cf72364d7d5c483ab82"
},
{
"url": "https://git.kernel.org/stable/c/bfc336a9fbbf09805f3dfe25c195a4db90af2846"
},
{
"url": "https://git.kernel.org/stable/c/976245094925bab9bc39366b2e9ab44ffcde61d0"
}
],
"title": "net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74719",
"datePublished": "2026-08-22T15:33:12.716Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:12.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74718 (GCVE-0-2026-74718)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
devlink: fix net namespace reference leak in reload
Summary
In the Linux kernel, the following vulnerability has been resolved:
devlink: fix net namespace reference leak in reload
devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net
with a held reference. When the requested namespace differs from the
current one and the reload action is not DRIVER_REINIT, the function
returns -EOPNOTSUPP without releasing the reference. Add the missing
put_net() on this error path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2edd92570441dd33246210042dc167319a5cf7e3 , < 7b6552e53426ea0539c667bbc5a524fdf7feae6f
(git)
Affected: 2edd92570441dd33246210042dc167319a5cf7e3 , < bf0797b92be591ac71d7c0f610e695caca3c72c9 (git) Affected: 2edd92570441dd33246210042dc167319a5cf7e3 , < 7b02c6d2a3cd2cd669f5c16685779f84328ae60c (git) Affected: 2edd92570441dd33246210042dc167319a5cf7e3 , < eda60c85b4f4c7d66b7141a5fe020b1a7f395341 (git) Affected: 2edd92570441dd33246210042dc167319a5cf7e3 , < 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/devlink/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b6552e53426ea0539c667bbc5a524fdf7feae6f",
"status": "affected",
"version": "2edd92570441dd33246210042dc167319a5cf7e3",
"versionType": "git"
},
{
"lessThan": "bf0797b92be591ac71d7c0f610e695caca3c72c9",
"status": "affected",
"version": "2edd92570441dd33246210042dc167319a5cf7e3",
"versionType": "git"
},
{
"lessThan": "7b02c6d2a3cd2cd669f5c16685779f84328ae60c",
"status": "affected",
"version": "2edd92570441dd33246210042dc167319a5cf7e3",
"versionType": "git"
},
{
"lessThan": "eda60c85b4f4c7d66b7141a5fe020b1a7f395341",
"status": "affected",
"version": "2edd92570441dd33246210042dc167319a5cf7e3",
"versionType": "git"
},
{
"lessThan": "1c4dac9bf1d2ac31da63b794bdec697777cbd0fd",
"status": "affected",
"version": "2edd92570441dd33246210042dc167319a5cf7e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/devlink/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: fix net namespace reference leak in reload\n\ndevlink_nl_reload_doit() calls devlink_netns_get(), which returns a net\nwith a held reference. When the requested namespace differs from the\ncurrent one and the reload action is not DRIVER_REINIT, the function\nreturns -EOPNOTSUPP without releasing the reference. Add the missing\nput_net() on this error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:12.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b6552e53426ea0539c667bbc5a524fdf7feae6f"
},
{
"url": "https://git.kernel.org/stable/c/bf0797b92be591ac71d7c0f610e695caca3c72c9"
},
{
"url": "https://git.kernel.org/stable/c/7b02c6d2a3cd2cd669f5c16685779f84328ae60c"
},
{
"url": "https://git.kernel.org/stable/c/eda60c85b4f4c7d66b7141a5fe020b1a7f395341"
},
{
"url": "https://git.kernel.org/stable/c/1c4dac9bf1d2ac31da63b794bdec697777cbd0fd"
}
],
"title": "devlink: fix net namespace reference leak in reload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74718",
"datePublished": "2026-08-22T15:33:12.106Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-22T15:33:12.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74717 (GCVE-0-2026-74717)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
net/mlx5: fw_tracer, return NULL on create error
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: fw_tracer, return NULL on create error
Tracer creation can fail by returning either NULL or ERR_PTR.
The return value is stored without a check on the device, and users
treat ERR_PTR and NULL the same way.
This also causes a crash in the core dump logic, which is missing the
ERR_PTR check and ends up dereferencing it, as shown in the trace below.
Switch tracer creation to return NULL on failure only, so callers only
need a single NULL check.
Internal error: Oops: 0000000096000006 [#1] SMP
Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core
CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)
Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]
pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]
lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]
sp : ffff800081cf3c40
x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000
x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05
x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000
x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0
x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac
x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650
x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8
x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e
Call trace:
mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)
mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]
devlink_health_do_dump+0x9c/0x160
devlink_health_report+0x1c0/0x288
mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]
process_one_work+0x15c/0x3d8
worker_thread+0x18c/0x320
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: b9400000 5ac00800 7a401800 540003ca (3940a260)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x000000,00078031,75fce5a1,35fffe67
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fd1483fe1f9fd45fe312adffb0faffa57446690d , < 47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0
(git)
Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < ee41ea49c4ab0e4015919f52ad23ec251d3b39d3 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 04599570c3a18f9ae7aad36825eb46f3dcd2c4e3 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 9a416f000285a94c1b723877547981dec8132434 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 80094352bd40ba54a33731f9c22872493983ed6d (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 4aafa600d93e9551c1f24e785d57cbd4adf021d5 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < af39eb111ce6b5eba9c08513b62c4868eb7e7fd5 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "ee41ea49c4ab0e4015919f52ad23ec251d3b39d3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "04599570c3a18f9ae7aad36825eb46f3dcd2c4e3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "9a416f000285a94c1b723877547981dec8132434",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "80094352bd40ba54a33731f9c22872493983ed6d",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "4aafa600d93e9551c1f24e785d57cbd4adf021d5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "af39eb111ce6b5eba9c08513b62c4868eb7e7fd5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, return NULL on create error\n\nTracer creation can fail by returning either NULL or ERR_PTR.\nThe return value is stored without a check on the device, and users\ntreat ERR_PTR and NULL the same way.\nThis also causes a crash in the core dump logic, which is missing the\nERR_PTR check and ends up dereferencing it, as shown in the trace below.\n\nSwitch tracer creation to return NULL on failure only, so callers only\nneed a single NULL check.\n\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core\n CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)\n Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]\n pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]\n lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]\n sp : ffff800081cf3c40\n x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000\n x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05\n x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000\n x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0\n x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac\n x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650\n x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8\n x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e\n Call trace:\n mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)\n mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]\n devlink_health_do_dump+0x9c/0x160\n devlink_health_report+0x1c0/0x288\n mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]\n process_one_work+0x15c/0x3d8\n worker_thread+0x18c/0x320\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n Code: b9400000 5ac00800 7a401800 540003ca (3940a260)\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Oops: Fatal exception\n SMP: stopping secondary CPUs\n Kernel Offset: disabled\n CPU features: 0x000000,00078031,75fce5a1,35fffe67\n Memory Limit: none\n ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On internet-facing cloud/HPC hosts with mlx5 PF NICs, a remote attacker can induce ConnectX firmware syndrome via crafted network/RDMA traffic; the kernel health poller then auto-invokes mlx5_fw_reporter_dump without any local syscall.\nAC:L - On affected hardware, mlx5_fw_tracer_create leaves ERR_PTR in dev-\u003etracer at probe (e.g. -EOPNOTSUPP when trace_to_memory is unset); once present, any FW syndrome or health miss counter event reliably queues the dump workqueue that dereferences the bad pointer.\nPR:N - The crash path shown in the fix oops is triggered automatically by mlx5_fw_reporter_err_work from the health poller with no userspace action; inducing FW syndrome over the network requires no host credentials, unlike the optional devlink dump path that needs CAP_NET_ADMIN.\nUI:N - Exploitation requires no victim interaction; the devlink health auto_dump fires from kernel workqueues when firmware reports a syndrome or miss-count threshold, independent of user actions such as mounts or file opens.\nS:U - Impact is confined to kernel crash/panic on the host running mlx5_core; there is no VM escape, IOMMU bypass, or crossing from guest VF context into a separate security authority beyond standard host kernel failure.\nC:N - The bug is an ERR_PTR mishandled as a valid mlx5_fw_tracer pointer; mlx5_fw_tracer_trigger_core_dump_general dereferences tracer-\u003eowner and faults immediately, producing an oops with no out-of-bounds read, UAF, or information disclosure primitive.\nI:N - Faulting on an ERR_PTR-encoded address does not corrupt adjacent memory or provide a controllable write primitive; the only outcome is an unrecoverable kernel oops/panic, not arbitrary modification or code execution.\nA:H - The fix commit documents a fatal kernel Oops in mlx5_fw_tracer_trigger_core_dump_general followed by \u0027Kernel panic - not syncing\u0027, causing complete loss of host availability on affected mlx5 PF systems when the FW reporter dump path runs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:59.788Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0"
},
{
"url": "https://git.kernel.org/stable/c/ee41ea49c4ab0e4015919f52ad23ec251d3b39d3"
},
{
"url": "https://git.kernel.org/stable/c/04599570c3a18f9ae7aad36825eb46f3dcd2c4e3"
},
{
"url": "https://git.kernel.org/stable/c/9a416f000285a94c1b723877547981dec8132434"
},
{
"url": "https://git.kernel.org/stable/c/b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb"
},
{
"url": "https://git.kernel.org/stable/c/80094352bd40ba54a33731f9c22872493983ed6d"
},
{
"url": "https://git.kernel.org/stable/c/4aafa600d93e9551c1f24e785d57cbd4adf021d5"
},
{
"url": "https://git.kernel.org/stable/c/af39eb111ce6b5eba9c08513b62c4868eb7e7fd5"
}
],
"title": "net/mlx5: fw_tracer, return NULL on create error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74717",
"datePublished": "2026-08-22T15:33:11.488Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:59.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74716 (GCVE-0-2026-74716)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears
VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM
object and then calls madvise(MADV_DONTNEED), the PTEs will be
successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP).
When userspace subsequently accesses the memory, drm_gem_shmem_fault()
handles the page fault and attempts to map the backing shmem page via
vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing
shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA
now has VM_MIXEDMAP set, won't this predictably trigger the explicit
assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn))
Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages()
pre-population with the handle_mm_fault() loop that was already used for
the import (dma-buf) path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e486147c912f653ef4b60a6c7dbd4168a4c56a9f , < 13339132d89d00b513dff0730bff3a313b9b13b5
(git)
Affected: e486147c912f653ef4b60a6c7dbd4168a4c56a9f , < 4a19f7ab5972ef608b31ae921419bc3e04b3f8ad (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13339132d89d00b513dff0730bff3a313b9b13b5",
"status": "affected",
"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f",
"versionType": "git"
},
{
"lessThan": "4a19f7ab5972ef608b31ae921419bc3e04b3f8ad",
"status": "affected",
"version": "e486147c912f653ef4b60a6c7dbd4168a4c56a9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()\n\nIn amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears\nVM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM\nobject and then calls madvise(MADV_DONTNEED), the PTEs will be\nsuccessfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP).\n\nWhen userspace subsequently accesses the memory, drm_gem_shmem_fault()\nhandles the page fault and attempts to map the backing shmem page via\nvmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing\nshmem page is normal system memory (pfn_valid(pfn) is true) and the VMA\nnow has VM_MIXEDMAP set, won\u0027t this predictably trigger the explicit\nassertion BUG_ON((vma-\u003evm_flags \u0026 VM_MIXEDMAP) \u0026\u0026 pfn_valid(pfn))\n\nFix by removing the vm_flags_mod() call and replacing the vm_insert_pages()\npre-population with the handle_mm_fault() loop that was already used for\nthe import (dma-buf) path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:10.876Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13339132d89d00b513dff0730bff3a313b9b13b5"
},
{
"url": "https://git.kernel.org/stable/c/4a19f7ab5972ef608b31ae921419bc3e04b3f8ad"
}
],
"title": "accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74716",
"datePublished": "2026-08-22T15:33:10.876Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-22T15:33:10.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74715 (GCVE-0-2026-74715)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
bpf: Fix netns reference imbalance in conntrack kfuncs
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix netns reference imbalance in conntrack kfuncs
The opts argument of the BPF conntrack kfuncs can point to a shared
map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
opts->netns_id separately when acquiring and releasing the network
namespace reference.
The reference imbalance can occur as follows:
CPU 0 CPU 1
read opts->netns_id (-1)
skip get_net_ns_by_id()
write opts->netns_id (id)
read opts->netns_id (id)
put_net(net) /* no matching get */
The reverse transition leaks the reference. Repeating the unmatched put
can destroy a live namespace and crash later users.
The kernel reported:
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
Call Trace:
__sys_bpf+0x1662/0x50c0
__x64_sys_bpf+0x73/0xb0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: Fatal exception
Snapshot every input field of opts with READ_ONCE() before validating or
using it. The netns_id snapshot keeps the namespace get/put pair
balanced, while the other snapshots keep the remaining options from
changing partway through an invocation. The individual reads can still
observe an inconsistent combination during a concurrent update, but each
selected field value remains stable for that invocation.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
aed8ee7feb44b6537af1e0b4f03365d42928be38 , < e5e060eb63d10b41ab60fd955649479d99b38210
(git)
Affected: aed8ee7feb44b6537af1e0b4f03365d42928be38 , < fdeba03fea78407a8c52faa99177c9f7f29f90eb (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5e060eb63d10b41ab60fd955649479d99b38210",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
},
{
"lessThan": "fdeba03fea78407a8c52faa99177c9f7f29f90eb",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix netns reference imbalance in conntrack kfuncs\n\nThe opts argument of the BPF conntrack kfuncs can point to a shared\nmap value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read\nopts-\u003enetns_id separately when acquiring and releasing the network\nnamespace reference.\n\nThe reference imbalance can occur as follows:\n\n CPU 0 CPU 1\n read opts-\u003enetns_id (-1)\n skip get_net_ns_by_id()\n write opts-\u003enetns_id (id)\n read opts-\u003enetns_id (id)\n put_net(net) /* no matching get */\n\nThe reverse transition leaks the reference. Repeating the unmatched put\ncan destroy a live namespace and crash later users.\n\nThe kernel reported:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n Call Trace:\n __sys_bpf+0x1662/0x50c0\n __x64_sys_bpf+0x73/0xb0\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n Kernel panic - not syncing: Fatal exception\n\nSnapshot every input field of opts with READ_ONCE() before validating or\nusing it. The netns_id snapshot keeps the namespace get/put pair\nbalanced, while the other snapshots keep the remaining options from\nchanging partway through an invocation. The individual reads can still\nobserve an inconsistent combination during a concurrent update, but each\nselected field value remains stable for that invocation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in BPF conntrack kfuncs reached only via the bpf() syscall (load, BPF_PROG_TEST_RUN, or attached XDP/TC programs), not from remote packet handling alone; kernel guidance classifies BPF as Local.\nAC:L - Exploitation needs a race on opts-\u003enetns_id in a shared BPF map value, but the attacker authors the program, drives concurrent bpf_map_update_elem and kfunc calls, and can pin threads to different CPUs to win the race reliably.\nPR:L - Triggering bpf_xdp_ct_lookup/bpf_skb_ct_lookup requires loading XDP or TC-BPF programs, which needs CAP_BPF and CAP_NET_ADMIN; both are obtainable by an unprivileged user inside a user/network namespace via unshare.\nUI:N - No victim interaction is required; the attacker loads their own BPF program, supplies map-backed opts, and runs concurrent test-run or traffic to trigger the refcount imbalance themselves.\nS:U - Impact is premature destruction of a live network namespace and kernel crashes within the same kernel security domain; it does not cross a VM, container-to-host, or IOMMU boundary.\nC:H - Repeated unmatched put_net() can drop a live namespace refcount to zero and free it while still in use, creating a net-namespace use-after-free that can expose freed kernel memory and enable information disclosure.\nI:H - The refcount corruption can destroy active network namespaces and corrupt kernel networking state; such lifetime bugs are memory corruption primitives that can be leveraged for arbitrary kernel modification or control-flow hijacking.\nA:H - The fix commit documents a reproduced general protection fault and kernel panic in bpf_prog_test_run_xdp from a null-ptr-deref after the namespace is destroyed, confirming complete system availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:58.565Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210"
},
{
"url": "https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb"
}
],
"title": "bpf: Fix netns reference imbalance in conntrack kfuncs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74715",
"datePublished": "2026-08-22T15:33:10.262Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:58.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74714 (GCVE-0-2026-74714)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto
the ehash chain, drops the bucket lock, and only afterwards sets
rsk_refcnt to 3.
Lockless readers such as __inet_lookup_established() handle this with
refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain
sock_hold() while holding the bucket lock, on the assumption that the
lock guarantees sk_refcnt > 0. That assumption does not hold for
request_sock:
CPU 0 CPU 1
----- -----
tcp_conn_request()
reqsk_queue_hash_req()
inet_ehash_insert(req)
spin_lock(bucket)
__sk_nulls_add_node_rcu(req) // rsk_refcnt == 0
spin_unlock(bucket)
bpf_iter_tcp_established_batch()
spin_lock(bucket)
sock_hold(req) <-- addition on 0
spin_unlock(bucket)
refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value
which surfaces as:
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1
Call Trace:
bpf_iter_tcp_established_batch+0x14e/0x170
bpf_iter_tcp_batch+0x53/0x200
bpf_iter_tcp_seq_next+0x27/0x70
bpf_seq_read+0x107/0x410
vfs_read+0xb9/0x380
The iterator's stolen reference is lost when the publishing CPU's
refcount_set() overwrites the count, leaving the socket one reference
short. When the last legitimate owner drops its reference the reqsk is
freed while still reachable, leading to use-after-free.
This reproduces in seconds with tcp_syncookies=0, a handful of threads
doing connect()/close() to a local listener while others read an
iter/tcp link in a tight loop.
Use refcount_inc_not_zero() and skip the socket on failure. A skipped
socket is still part of the bucket, so keep counting it in expected.
The reallocations are sized from expected, and a request sock whose
refcount gets published while the lock is held across the last realloc
must already have room.
A skipped socket is counted in expected but never batched, so end_sk
can be short of expected on a batch that is actually complete. Decide
completeness by whether the walk left any socket behind instead. The
WARN after the locked realloc checks the same, replacing an
end_sk == expected check that could not hold on that path since
commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always
contains a full bucket snapshot").
If every matching socket in a bucket is mid-init (refcount 0), end_sk
stays 0. Advance to the next bucket rather than returning a batch entry
that was never filled this round.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
04c7820b776f1c4b48698574c47de9e940d368e8 , < cc0295f89296ed351fc4b0b48fee887ba02c5d24
(git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < ddbe966b5d1fe212ada749bc3d0b410f1a7dea74 (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 7d2b60a4bc0499f62ff8520af6309bbe170882fd (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < cefcbbe20846a45f9a7dae868f7ef1000953e2df (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 97e74d3e45d653c07c2d406fc530a9bbe3df8396 (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < e5fd3f514e27db1f05fbd72ba615d74941e23c51 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\nrequest_sock:\n\n CPU 0 CPU 1\n ----- -----\n tcp_conn_request()\n reqsk_queue_hash_req()\n inet_ehash_insert(req)\n spin_lock(bucket)\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\n spin_unlock(bucket)\n bpf_iter_tcp_established_batch()\n spin_lock(bucket)\n sock_hold(req) \u003c-- addition on 0\n spin_unlock(bucket)\n refcount_set(\u0026req-\u003ersk_refcnt, 3) // clobbers saturated value\n\nwhich surfaces as:\n\n refcount_t: addition on 0; use-after-free.\n WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n Call Trace:\n bpf_iter_tcp_established_batch+0x14e/0x170\n bpf_iter_tcp_batch+0x53/0x200\n bpf_iter_tcp_seq_next+0x27/0x70\n bpf_seq_read+0x107/0x410\n vfs_read+0xb9/0x380\n\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter-\u003ebatch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - bpf_iter_tcp_established_batch() is reached only via local bpf() to load a BPF_TRACE_ITER TCP program, create an iterator link/fd, and read() it (bpf_seq_read-\u003ebpf_iter_tcp_batch); per kernel CNA guidance BPF iterator paths are Local even though concurrent TCP_NEW_SYN_RECV creation can be driven by network SYNs.\nAC:L - The fix commit reproduces in seconds with threads doing connect()/close() while others read iter/tcp in a tight loop; the attacker controls both the BPF iterator and TCP connection churn, so the refcount race between sock_hold() and refcount_set() is reliably winnable without uncontrollable victim state.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low privileges because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - No victim interaction is required; the attacker loads their own iter/tcp BPF program and link, then triggers the race with self-generated connect/close traffic or SYN activity to listeners in the iterated network namespace.\nS:U - Impact is a kernel heap use-after-free and memory corruption within the same host kernel security authority; this is standard local kernel compromise/crash, not a VM escape, sandbox boundary cross, or IOMMU bypass.\nC:H - The iterator retains dangling request_sock pointers after refcount_set() clobbers a sock_hold() taken on sk_refcnt==0; subsequent bpf_iter_tcp_seq_show/put_batch dereference freed kernel objects, giving UAF read primitives per kernel CNA UAF guidance.\nI:H - Freed request_sock slabs can be reallocated while the iterator batch still references them; UAF enables corrupted socket metadata, refcount abuse, and control-flow hijacking via heap grooming, meeting High integrity under kernel CNA memory-corruption guidance.\nA:H - The bug surfaces as refcount_warn_saturate and leaves the reqsk one reference short so it is freed while still reachable from the iterator batch, causing kernel oops/panic; the tight-loop repro shows reliable, repeatable host denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:57.341Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"
},
{
"url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"
},
{
"url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"
},
{
"url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"
},
{
"url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"
},
{
"url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"
}
],
"title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74714",
"datePublished": "2026-08-22T15:33:09.643Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:57.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74713 (GCVE-0-2026-74713)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
vhost_iotlb: bound map allocation in add_range
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost_iotlb: bound map allocation in add_range
vhost_iotlb_add_range_ctx() only retires an old entry when the table
has a non-zero limit, has exactly reached that limit and has
VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating
entries after reaching their configured limit.
Existing vhost devices allocate their IOTLB with max_iotlb_entries from
vhost.c, which defaults to 2048 and is tunable by module parameter. Use
the caller-provided limit at the allocation point instead of adding a
separate default in the common IOTLB helper, and reject non-positive
values in vhost paths that can report an error.
Other vhost IOTLB users should not create zero-limit tables when entries
can be populated from userspace or guest-controlled requests. Add
caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and
vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require
at least two entries for vdpa_sim and mlx5 vDPA paths that install
full-range mappings, since those mappings are split into two IOTLB
entries.
Handle full-range mappings in the common helper by checking that the
IOTLB can hold both split entries before inserting the first half. This
avoids returning an error after leaving a half mapping behind.
When the table is full, keep the existing retire behavior for retiring
tables and return -ENOSPC for non-retiring tables. Reuse the retired map
node instead of freeing it and allocating a replacement, so a stream of
IOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table
has reached its limit. If a zero-limit IOTLB still reaches the common
helper, treat it as a configuration error and return -EINVAL.
I found this bug myself, though the patch was written with AI assistance.
Severity
7.1 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0bbe30668d89ec8a309f28ced6d092c90fb23e8c , < ae128dd19040ee06a4f8143c7ced4d18080d7a9a
(git)
Affected: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c , < 1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94 (git) |
|
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/core/mlx5_vdpa.h",
"drivers/vdpa/mlx5/core/mr.c",
"drivers/vdpa/mlx5/core/resources.c",
"drivers/vdpa/vdpa_sim/vdpa_sim.c",
"drivers/vdpa/vdpa_user/iova_domain.c",
"drivers/vhost/iotlb.c",
"drivers/vhost/vdpa.c",
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae128dd19040ee06a4f8143c7ced4d18080d7a9a",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
},
{
"lessThan": "1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/core/mlx5_vdpa.h",
"drivers/vdpa/mlx5/core/mr.c",
"drivers/vdpa/mlx5/core/resources.c",
"drivers/vdpa/vdpa_sim/vdpa_sim.c",
"drivers/vdpa/vdpa_user/iova_domain.c",
"drivers/vhost/iotlb.c",
"drivers/vhost/vdpa.c",
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost_iotlb: bound map allocation in add_range\n\nvhost_iotlb_add_range_ctx() only retires an old entry when the table\nhas a non-zero limit, has exactly reached that limit and has\nVHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating\nentries after reaching their configured limit.\n\nExisting vhost devices allocate their IOTLB with max_iotlb_entries from\nvhost.c, which defaults to 2048 and is tunable by module parameter. Use\nthe caller-provided limit at the allocation point instead of adding a\nseparate default in the common IOTLB helper, and reject non-positive\nvalues in vhost paths that can report an error.\n\nOther vhost IOTLB users should not create zero-limit tables when entries\ncan be populated from userspace or guest-controlled requests. Add\ncaller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and\nvhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require\nat least two entries for vdpa_sim and mlx5 vDPA paths that install\nfull-range mappings, since those mappings are split into two IOTLB\nentries.\n\nHandle full-range mappings in the common helper by checking that the\nIOTLB can hold both split entries before inserting the first half. This\navoids returning an error after leaving a half mapping behind.\n\nWhen the table is full, keep the existing retire behavior for retiring\ntables and return -ENOSPC for non-retiring tables. Reuse the retired map\nnode instead of freeing it and allocating a replacement, so a stream of\nIOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table\nhas reached its limit. If a zero-limit IOTLB still reaches the common\nhelper, treat it as a configuration error and return -EINVAL.\n\nI found this bug myself, though the patch was written with AI assistance."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached via local VHOST_IOTLB_UPDATE writes on /dev/vhost-* or /dev/vhost-vdpa char devices, or when a KVM guest drives virtio IOTLB misses that the VMM resolves through vhost; it is not triggered by remote network packets.\nAC:L - An attacker reliably floods distinct IOTLB mappings by repeatedly issuing VHOST_IOTLB_UPDATE messages or provoking guest IOTLB misses; no race, rare configuration, or attacker-uncontrollable memory layout is required once vhost IOTLB is active.\nPR:N - A malicious KVM guest can provoke unbounded IOTLB growth through normal virtio IOTLB-miss handling without any host credentials; a host attacker holding the vhost-vdpa/vhost device node also needs no capabilities beyond device access.\nUI:N - Exploitation requires no victim interaction beyond the VM or vhost device already being in use; the attacker programmatically drives the IOTLB update stream in a tight loop.\nS:C - In cloud/KVM deployments, an unprivileged guest VM causes unbounded host-kernel GFP_ATOMIC allocations in vhost_iotlb_add_range_ctx(), crossing the VM/host security boundary to deny service on the hypervisor.\nC:N - The bug causes only unbounded kmalloc of vhost_iotlb_map structures without out-of-bounds access, use-after-free, or information disclosure; successful exploitation does not read kernel memory.\nI:N - No memory corruption or arbitrary write occurs; impact is limited to kernel memory consumption and does not modify data or enable code execution through the allocation flaw itself.\nA:H - Unbounded IOTLB entry allocation or perpetual GFP_ATOMIC kmalloc when tables are at capacity exhausts kernel memory/atomic reserves, causing host OOM, kernel panics, or complete hypervisor denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:56.127Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae128dd19040ee06a4f8143c7ced4d18080d7a9a"
},
{
"url": "https://git.kernel.org/stable/c/1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94"
}
],
"title": "vhost_iotlb: bound map allocation in add_range",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74713",
"datePublished": "2026-08-22T15:33:09.028Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:56.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74712 (GCVE-0-2026-74712)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
vdpa/mlx5: Fix buffer length in create_direct_keys()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: Fix buffer length in create_direct_keys()
We have seen in our CI the following KASAN message:
BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]
Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764
[...]
[<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core]
[<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]
[<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa]
[<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa]
[...]
The buggy address is located 4128 bytes inside of
allocated 4384-byte region [0000000176794000, 0000000176795120)
So in essence we read 16 bytes beyond 4384-byte allocation.
create_direct_keys calculates the pointer and length for in and out
buffers.
The size calculation for in includes the entire structure
size (out + in + mtt[]) but the pointer passed to cmd_exec points only
to the 'in' field, skipping the 'out' field.
This causes mlx5_copy_to_msg() to read beyond the allocated buffer
by sizeof(out) bytes when copying command data.
Properly calculate the input size to match the pointer and allocation size.
Severity
9.3 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0071b138d44af4296bf871e6624369ce697b4b15 , < ec3bb289cf19d526224117d5d450a5fd9cbd5ab2
(git)
Affected: 0071b138d44af4296bf871e6624369ce697b4b15 , < cde8931a25392670dd59a0acfcab87a830ab66c5 (git) Affected: 0071b138d44af4296bf871e6624369ce697b4b15 , < 6c8a9f7bc00301e533a5366384f3070a8e7f8430 (git) Affected: 0071b138d44af4296bf871e6624369ce697b4b15 , < 727e1f569855df83579edbd73dcb4a0723543a12 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/core/mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ec3bb289cf19d526224117d5d450a5fd9cbd5ab2",
"status": "affected",
"version": "0071b138d44af4296bf871e6624369ce697b4b15",
"versionType": "git"
},
{
"lessThan": "cde8931a25392670dd59a0acfcab87a830ab66c5",
"status": "affected",
"version": "0071b138d44af4296bf871e6624369ce697b4b15",
"versionType": "git"
},
{
"lessThan": "6c8a9f7bc00301e533a5366384f3070a8e7f8430",
"status": "affected",
"version": "0071b138d44af4296bf871e6624369ce697b4b15",
"versionType": "git"
},
{
"lessThan": "727e1f569855df83579edbd73dcb4a0723543a12",
"status": "affected",
"version": "0071b138d44af4296bf871e6624369ce697b4b15",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/core/mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa/mlx5: Fix buffer length in create_direct_keys()\n\nWe have seen in our CI the following KASAN message:\nBUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]\nRead of size 272 at addr 0000000176795020 by task qemu-system-s39/82764\n[...]\n[\u003c000011388ab3a7a0\u003e] cmd_exec+0x550/0xca0 [mlx5_core]\n[\u003c000011388ab3b61c\u003e] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]\n[\u003c000011388b21e82e\u003e] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa]\n[\u003c000011388b21fd44\u003e] create_direct_keys+0x954/0xef0 [mlx5_vdpa]\n[...]\nThe buggy address is located 4128 bytes inside of\nallocated 4384-byte region [0000000176794000, 0000000176795120)\n\nSo in essence we read 16 bytes beyond 4384-byte allocation.\ncreate_direct_keys calculates the pointer and length for in and out\nbuffers.\nThe size calculation for in includes the entire structure\nsize (out + in + mtt[]) but the pointer passed to cmd_exec points only\nto the \u0027in\u0027 field, skipping the \u0027out\u0027 field.\n\nThis causes mlx5_copy_to_msg() to read beyond the allocated buffer\nby sizeof(out) bytes when copying command data.\n\nProperly calculate the input size to match the pointer and allocation size."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached when host vDPA memory keys are created during IOTLB/set_map handling on /dev/vhost-vdpa (ioctl/write from QEMU/vhost), not from remote network packet processing; worst case is a co-tenant VM guest driving host QEMU virtio memory updates on the same mlx5 vDPA host.\nAC:L - Once mlx5 vDPA user MR setup runs, create_direct_keys() always passes an oversized inlen to mlx5_cmd_exec_cb(), deterministically causing mlx5_copy_to_msg() to read past the slab allocation; no race or victim state is required beyond normal virtio memory mapping.\nPR:N - In cloud mlx5 virtio-vDPA deployments a malicious VM tenant needs no host credentials\u2014normal guest virtio-net bring-up causes QEMU to issue vhost IOTLB updates that invoke mlx5_vdpa_set_map() and create_user_mr() on the host without CAP_NET_ADMIN or root in the host init namespace.\nUI:N - Exploitation requires only automated virtio driver initialization and memory table updates; no additional victim clicks, mounts, or manual actions are needed beyond provisioning a vDPA-backed VM, which is the intended operational path.\nS:C - The vulnerable mlx5 vDPA code runs in the hypervisor host kernel while the practical attacker is a guest VM tenant; successful slab out-of-bounds reads and corrupted firmware commands cross the guest/host virtualization boundary per KVM guest-to-host guidance.\nC:H - Incorrect inlen makes mlx5_copy_to_msg() perform a slab out-of-bounds read (KASAN-reported) of adjacent kernel heap memory, copying leaked bytes into CREATE_MKEY commands and enabling arbitrary kernel information disclosure, not a bounded benign leak.\nI:H - The over-read injects adjacent heap contents into firmware CREATE_MKEY command buffers, corrupting memory-key setup data sent to the mlx5 device; this is exploitable kernel memory corruption that can alter device DMA mappings and enable further control, not a read-only crash.\nA:H - The flaw triggers a KASAN slab-out-of-bounds fault in mlx5_core cmd_exec() during normal MR creation; such heap corruption commonly causes kernel oops/panic and can also destabilize vDPA networking on repeated virtio memory remaps."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:54.897Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ec3bb289cf19d526224117d5d450a5fd9cbd5ab2"
},
{
"url": "https://git.kernel.org/stable/c/cde8931a25392670dd59a0acfcab87a830ab66c5"
},
{
"url": "https://git.kernel.org/stable/c/6c8a9f7bc00301e533a5366384f3070a8e7f8430"
},
{
"url": "https://git.kernel.org/stable/c/727e1f569855df83579edbd73dcb4a0723543a12"
}
],
"title": "vdpa/mlx5: Fix buffer length in create_direct_keys()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74712",
"datePublished": "2026-08-22T15:33:08.392Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:54.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74711 (GCVE-0-2026-74711)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
hwmon: (pmbus) Fix type confusion in notification logic
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus) Fix type confusion in notification logic
Sashiko reports:
At the start of the loop in pmbus_notify(), the code unconditionally casts
every attribute to a struct sensor_device_attribute:
drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {
for (i = 0; i < data->num_attributes; i++) {
struct device_attribute *da = to_dev_attr(data->group.attrs[i]);
struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
int index = attr->index;
...
}
However, data->group.attrs can contain other types like struct
pmbus_samples_reg or struct pmbus_sensor, which only embed a base
struct device_attribute.
If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting
it to struct sensor_device_attribute and reading the index field appears
to access memory past the end of the allocation, which might trigger a
slab-out-of-bounds read.
Additionally, if da is a struct pmbus_sensor, casting it causes the index
field to overlap with the page, phase, and reg fields. Could this produce
a garbage mask on little-endian systems that spuriously matches the target
reg, page, and flags during an alert?
Fix the problem by using struct sensor_device_attr in struct pmbus_sensor
and struct pmbus_label. Since those attributes never trigger a
notification, set the value of attr->index to -1 for them. Use this value
to distinguish from boolean attributes which _can_ trigger a notification
and use the index field to encode mask, page, and register values.
Severity
8.4 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f469bde9afd136598a0c4edc054296e6046f90ee , < 821f6416e69782fa662aff94b5ea52c943042790
(git)
Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 0b121de89a99c54bcf516999b04e8531c84f08d5 (git) Affected: f469bde9afd136598a0c4edc054296e6046f90ee , < 59bd68ab05a8f9c9a60b6ec44682084184803ff4 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "821f6416e69782fa662aff94b5ea52c943042790",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "0b121de89a99c54bcf516999b04e8531c84f08d5",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "59bd68ab05a8f9c9a60b6ec44682084184803ff4",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n for (i = 0; i \u003c data-\u003enum_attributes; i++) {\n struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\n struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n int index = attr-\u003eindex;\n...\n}\n\nHowever, data-\u003egroup.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flawed pmbus_notify() runs only in the PMBus SMBALERT threaded IRQ handler after the host kernel reads fault status from an on-board I2C/SMBus PSU/PMIC; reaching it requires local presence on a system exposing that bus, not a remote network protocol.\nAC:L - Once SMBALERT IRQ handling is enabled, the type confusion and slab out-of-bounds read occur deterministically on every alert while iterating attributes; an attacker can repeatedly provoke PSU/PMIC faults (e.g., sustained CPU/GPU load) rather than depend on uncontrollable timing.\nPR:N - No special kernel capability is needed to hit the IRQ path\u2014any unprivileged local process that can drive hardware into an overcurrent/overtemp fault (cloud tenant, factory HMI user, embedded service account) can cause SMBALERT and exercise the bug.\nUI:N - Exploitation is driven by attacker-induced or naturally occurring PMBus fault interrupts and does not require any victim to open files, click prompts, or perform other interactive actions.\nS:U - Impact is confined to kernel memory safety within the host OS security authority; it is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority compromise.\nC:H - Casting pmbus_samples_reg device attributes to sensor_device_attribute reads attr-\u003eindex past the object end (slab out-of-bounds), and pmbus_sensor casts reinterpret adjacent page/phase/reg bytes as an index, enabling kernel heap metadata or pointer disclosure.\nI:H - This is a type confusion in kernel notification logic: mis-decoded indices can spuriously satisfy reg/page/mask checks and drive sysfs_notify/uevent on unintended attributes, a memory-safety defect with potential for further corruption primitives.\nA:H - The out-of-bounds slab read and malformed attribute matching in interrupt context can trigger KASAN/BUG faults or kernel oops/panic when alerts fire on production systems with PMBus SMBALERT wired."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:53.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"
},
{
"url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"
},
{
"url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"
}
],
"title": "hwmon: (pmbus) Fix type confusion in notification logic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74711",
"datePublished": "2026-08-22T15:33:07.779Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:53.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74710 (GCVE-0-2026-74710)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
xsk: require at least 16 bytes of TX metadata
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: require at least 16 bytes of TX metadata
AF_XDP accepts a TX metadata length as small as eight bytes, but every
supported request needs the flags plus at least one eight-byte request
field. Such short metadata also lets the kernel read beyond the registered
area.
Require 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve
compatibility with applications that do not use launch-time metadata.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < 21b8536aee819792f1b4b38b9aacf2a073025d49
(git)
Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < 642c6e73fce17fdca93a5793c4d22359fda866d7 (git) Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < cfb9d2976b277e554e28c165e3eff4b4a8ea10bd (git) Affected: 341ac980eab90ac1f6c22ee9f9da83ed9604d899 , < 1bb30b181d9f0484e141f8411e15ed906d5c6780 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xdp/xdp_umem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21b8536aee819792f1b4b38b9aacf2a073025d49",
"status": "affected",
"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
"versionType": "git"
},
{
"lessThan": "642c6e73fce17fdca93a5793c4d22359fda866d7",
"status": "affected",
"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
"versionType": "git"
},
{
"lessThan": "cfb9d2976b277e554e28c165e3eff4b4a8ea10bd",
"status": "affected",
"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
"versionType": "git"
},
{
"lessThan": "1bb30b181d9f0484e141f8411e15ed906d5c6780",
"status": "affected",
"version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xdp/xdp_umem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: require at least 16 bytes of TX metadata\n\nAF_XDP accepts a TX metadata length as small as eight bytes, but every\nsupported request needs the flags plus at least one eight-byte request\nfield. Such short metadata also lets the kernel read beyond the registered\narea.\n\nRequire 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve\ncompatibility with applications that do not use launch-time metadata."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local AF_XDP setup\u2014socket(AF_XDP), setsockopt(XDP_UMEM_REG) with tx_metadata_len=8, ring configuration, bind, and TX descriptor submission\u2014not via remote packet handling or network-facing services.\nAC:L - The attacker fully controls tx_metadata_len, descriptor addresses, metadata flags, and TX timing, and can place frames at chunk boundaries to reliably trigger kernel reads/writes past the declared 8-byte metadata headroom.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW (xsk_create()); per kernel CNA guidance this is Low because unprivileged processes can obtain it inside user/network namespaces (e.g., unshare -Urn).\nUI:N - No victim action is required; the attacker configures their own AF_XDP socket, UMEM, rings, and TX descriptors to trigger the faulty metadata handling during transmit.\nS:U - Impact is confined to kernel processing of attacker-supplied AF_XDP metadata and pinned UMEM frames; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - With only 8 bytes registered, the kernel still dereferences xsk_tx_metadata request fields (checksum, launch time) beyond the metadata area; this out-of-bounds read can cross chunk/UMEM boundaries and expose adjacent memory.\nI:H - TX timestamp completion writes through meta-\u003ecompletion.tx_timestamp when only 8 bytes of metadata were reserved, causing an out-of-bounds write past the registered metadata headroom that can corrupt adjacent memory or be leveraged further.\nA:H - Reading or writing metadata fields beyond the registered length at chunk/UMEM edges can access unmapped pages and trigger kernel faults; out-of-bounds kernel accesses in this path can cause oops/panic-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:52.464Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21b8536aee819792f1b4b38b9aacf2a073025d49"
},
{
"url": "https://git.kernel.org/stable/c/642c6e73fce17fdca93a5793c4d22359fda866d7"
},
{
"url": "https://git.kernel.org/stable/c/cfb9d2976b277e554e28c165e3eff4b4a8ea10bd"
},
{
"url": "https://git.kernel.org/stable/c/1bb30b181d9f0484e141f8411e15ed906d5c6780"
}
],
"title": "xsk: require at least 16 bytes of TX metadata",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74710",
"datePublished": "2026-08-22T15:33:07.172Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-25T05:41:52.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74709 (GCVE-0-2026-74709)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
xsk: clear metadata pointer when no timestamp is requested
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: clear metadata pointer when no timestamp is requested
User space can change metadata flags after request processing. Rereading
them during completion can therefore make the kernel write a timestamp
that was not requested when the packet was submitted.
Clear the metadata pointer during request processing unless timestamp
completion is requested. Completion handling can then use the pointer
itself instead of rereading the flags.
On the mlx5 multi-packet WQE path metadata is evaluated per batch:
xsk_tx_metadata_request() runs only for the descriptor that starts a
session, just like the checksum offload that is applied once through the
shared WQE. Only that descriptor's pointer is reset, so completion
handling can record a timestamp for the other descriptors of the session
regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays
inside the metadata area; the single-WQE, other zero-copy, and generic
paths reset the pointer per descriptor and are unaffected.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 0ba2e1eb07a826d021344e2f146b6716c58139eb
(git)
Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < eb4c613d4ebc3f664e70d572b8867ba114a8754e (git) Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 9f60a67df8d3c862503bee62bada8e7089cba438 (git) Affected: d9d736c416c9a85f84e15435ba82a177262e745b (git) Affected: 6.14.2 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ba2e1eb07a826d021344e2f146b6716c58139eb",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"lessThan": "eb4c613d4ebc3f664e70d572b8867ba114a8754e",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"lessThan": "9f60a67df8d3c862503bee62bada8e7089cba438",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"status": "affected",
"version": "d9d736c416c9a85f84e15435ba82a177262e745b",
"versionType": "git"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: clear metadata pointer when no timestamp is requested\n\nUser space can change metadata flags after request processing. Rereading\nthem during completion can therefore make the kernel write a timestamp\nthat was not requested when the packet was submitted.\n\nClear the metadata pointer during request processing unless timestamp\ncompletion is requested. Completion handling can then use the pointer\nitself instead of rereading the flags.\n\nOn the mlx5 multi-packet WQE path metadata is evaluated per batch:\nxsk_tx_metadata_request() runs only for the descriptor that starts a\nsession, just like the checksum offload that is applied once through the\nshared WQE. Only that descriptor\u0027s pointer is reset, so completion\nhandling can record a timestamp for the other descriptors of the session\nregardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays\ninside the metadata area; the single-WQE, other zero-copy, and generic\npaths reset the pointer per descriptor and are unaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:06.558Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ba2e1eb07a826d021344e2f146b6716c58139eb"
},
{
"url": "https://git.kernel.org/stable/c/eb4c613d4ebc3f664e70d572b8867ba114a8754e"
},
{
"url": "https://git.kernel.org/stable/c/9f60a67df8d3c862503bee62bada8e7089cba438"
}
],
"title": "xsk: clear metadata pointer when no timestamp is requested",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74709",
"datePublished": "2026-08-22T15:33:06.558Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-22T15:33:06.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74708 (GCVE-0-2026-74708)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
xsk: validate launch-time metadata size
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate launch-time metadata size
Launch-time metadata extends beyond the first 16 bytes of struct
xsk_tx_metadata. Reject the request when the registered metadata area does
not contain the complete field.
Snapshot the validated flags for the generic transmit path and use that
snapshot for request and completion processing, avoiding inconsistent
decisions if user space changes the flags concurrently.
Note that only xsk_skb_metadata is properly using the flags,
__xsk_buff_get_metadata ignores them. Next commits address that.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < af511afa1d2977f384044df78d6fbf9fba653f7a
(git)
Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < bc63d47611c07b0d5d655fe1a590861931527920 (git) Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 439ce2dddf3d22129b9113a7881637256a35e936 (git) Affected: d9d736c416c9a85f84e15435ba82a177262e745b (git) Affected: 6.14.2 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock_drv.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af511afa1d2977f384044df78d6fbf9fba653f7a",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"lessThan": "bc63d47611c07b0d5d655fe1a590861931527920",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"lessThan": "439ce2dddf3d22129b9113a7881637256a35e936",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"status": "affected",
"version": "d9d736c416c9a85f84e15435ba82a177262e745b",
"versionType": "git"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock_drv.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate launch-time metadata size\n\nLaunch-time metadata extends beyond the first 16 bytes of struct\nxsk_tx_metadata. Reject the request when the registered metadata area does\nnot contain the complete field.\n\nSnapshot the validated flags for the generic transmit path and use that\nsnapshot for request and completion processing, avoiding inconsistent\ndecisions if user space changes the flags concurrently.\n\nNote that only xsk_skb_metadata is properly using the flags,\n__xsk_buff_get_metadata ignores them. Next commits address that."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local process to create an AF_XDP socket, register UMEM/TX rings via setsockopt, bind to a netdev queue, and submit TX descriptors; the bug is hit in kernel transmit handling, not by remote packet delivery alone.\nAC:L - An attacker fully controls UMEM layout, metadata flags, and TX ring timing, so registering tx_metadata_len=16, setting XDP_TXMD_FLAGS_LAUNCH_TIME, and racing concurrent flag writes can reliably trigger the out-of-bounds launch_time read without uncontrollable kernel preconditions.\nPR:L - AF_XDP socket creation checks CAP_NET_RAW in the socket network namespace (xsk_create), which unprivileged local users can obtain via user/network namespaces; no init-namespace root or admin rights are required beyond that capability.\nUI:N - No victim interaction is needed after the attacker can run code with CAP_NET_RAW; they directly configure UMEM metadata, enqueue TX descriptors, and drive transmission via sendmsg/poll without requiring another user to open files or mount filesystems.\nS:U - Impact stays within the kernel networking stack and attacker-controlled AF_XDP context on the same host; it does not cross VM, container-to-host, or IOMMU security boundaries into a different authority.\nC:H - With only 16 bytes of registered TX metadata, enabling launch-time offload makes the kernel read meta-\u003erequest.launch_time eight bytes beyond the declared metadata area; this is an out-of-bounds read whose contents are then consumed by kernel TX processing.\nI:H - The out-of-bounds launch_time value is written into skb-\u003eskb_mstamp_ns on the generic path and can be passed to NIC launch-time hardware offload on zerocopy drivers, letting an attacker influence kernel packet scheduling state and device transmit timing from attacker-chosen memory.\nA:H - Repeated transmission with attacker-controlled launch-time values can disrupt TX scheduling and stress hardware offload paths (mlx5/igc/stmmac), enabling denial of service through stalled or mis-timed transmission rather than only a single benign misread."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:51.238Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af511afa1d2977f384044df78d6fbf9fba653f7a"
},
{
"url": "https://git.kernel.org/stable/c/bc63d47611c07b0d5d655fe1a590861931527920"
},
{
"url": "https://git.kernel.org/stable/c/439ce2dddf3d22129b9113a7881637256a35e936"
}
],
"title": "xsk: validate launch-time metadata size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74708",
"datePublished": "2026-08-22T15:33:05.956Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-25T05:41:51.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74707 (GCVE-0-2026-74707)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
xsk: validate metadata when processing requests
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate metadata when processing requests
The zero-copy path validates TX metadata while obtaining the descriptor
context, then reads it again later when preparing the hardware request.
User space can change the metadata between those operations and bypass the
original validation.
Validate the metadata in xsk_tx_metadata_request() and use the resulting
flags snapshot for every feature check. Read request fields once so all
zero-copy drivers process only values observed after successful
validation.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 5fd121971912dee2f5af1efec64462ac722deb17
(git)
Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba (git) Affected: ca4419f15abd19ba8be1e109661b60f9f5b6c9f0 , < 849b1664dbda1cf6c63e0fd4f9dec23782b8c851 (git) Affected: d9d736c416c9a85f84e15435ba82a177262e745b (git) Affected: 6.14.2 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c",
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c",
"include/net/libeth/xsk.h",
"include/net/xdp_sock_drv.h",
"net/xdp/xsk_buff_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5fd121971912dee2f5af1efec64462ac722deb17",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"lessThan": "0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"lessThan": "849b1664dbda1cf6c63e0fd4f9dec23782b8c851",
"status": "affected",
"version": "ca4419f15abd19ba8be1e109661b60f9f5b6c9f0",
"versionType": "git"
},
{
"status": "affected",
"version": "d9d736c416c9a85f84e15435ba82a177262e745b",
"versionType": "git"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c",
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c",
"include/net/libeth/xsk.h",
"include/net/xdp_sock_drv.h",
"net/xdp/xsk_buff_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate metadata when processing requests\n\nThe zero-copy path validates TX metadata while obtaining the descriptor\ncontext, then reads it again later when preparing the hardware request.\nUser space can change the metadata between those operations and bypass the\noriginal validation.\n\nValidate the metadata in xsk_tx_metadata_request() and use the resulting\nflags snapshot for every feature check. Read request fields once so all\nzero-copy drivers process only values observed after successful\nvalidation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through local AF_XDP setup (socket, UMEM registration, TX ring submission) and zero-copy driver transmit on bound netdev queues; remote peers cannot directly trigger xsk_tx_metadata_request() without local control of an AF_XDP socket.\nAC:L - The attacker fully controls mmap\u0027d UMEM metadata and can race concurrent writes (or helper threads) between early validation in get_ctx/get_metadata and the later xsk_tx_metadata_request() read, reliably creating the TOCTOU window.\nPR:L - Creating an AF_XDP socket requires CAP_NET_RAW in the relevant network user namespace (xsk_create); unprivileged local users can obtain this capability via user/network namespaces (e.g., unshare -Urn), matching CNA guidance for net stack local attack surface.\nUI:N - Exploitation requires only the attacker configuring AF_XDP zero-copy TX, crafting metadata, and submitting descriptors; no separate victim user action is needed beyond normal attacker-controlled local execution.\nS:U - Impact is confined to kernel/driver transmit state on the host where the AF_XDP socket runs; it does not cross VM, IOMMU, or sandbox security boundaries into another authority.\nC:H - Bypassing metadata validation can enable unchecked launch-time/checksum offload handlers that misread fields and corrupt kernel TX ring/descriptor state, providing a plausible kernel memory disclosure primitive consistent with related AF_XDP metadata TOCTOU issues.\nI:H - After validation, userspace can flip flags and request fields so zero-copy drivers (igc/stmmac/mlx5/libeth) program hardware with unvalidated launch_time or checksum requests, corrupting in-kernel TX descriptors and transmit control structures.\nA:H - Illegal hardware offload activation or corrupted TX ring accounting can kernel-oops, panic, or wedge NIC transmit queues; the attacker can repeatedly trigger the path via continuous AF_XDP zero-copy transmissions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:50.013Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5fd121971912dee2f5af1efec64462ac722deb17"
},
{
"url": "https://git.kernel.org/stable/c/0cc7aa6e0d19027fdd42e6fbd156267ac1e3bbba"
},
{
"url": "https://git.kernel.org/stable/c/849b1664dbda1cf6c63e0fd4f9dec23782b8c851"
}
],
"title": "xsk: validate metadata when processing requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74707",
"datePublished": "2026-08-22T15:33:05.337Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-25T05:41:50.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74706 (GCVE-0-2026-74706)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
bnge: Fix NULL pointer dereference in aux device release
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnge: Fix NULL pointer dereference in aux device release
If allocation of auxr_dev fails during auxiliary device setup, the error
path calls auxiliary_device_uninit(), which eventually invokes
bnge_aux_dev_release().
The release callback unconditionally dereferences aux_priv->auxr_dev->pdev
to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated
on this failure path, the dereference results in a NULL pointer exception
Retrieve the parent bnge_dev from the auxiliary device's parent instead of
auxr_dev, and free auxr_dev only when it was successfully allocated. This
allows the release callback to correctly clean up partially initialized
auxiliary devices.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554 , < 83ef2f3cab7fe6dd9155cd598dc64be524d963a9
(git)
Affected: 8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554 , < 1cb4298810e27e037d3ca07286ecbb97e89ba58d (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83ef2f3cab7fe6dd9155cd598dc64be524d963a9",
"status": "affected",
"version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554",
"versionType": "git"
},
{
"lessThan": "1cb4298810e27e037d3ca07286ecbb97e89ba58d",
"status": "affected",
"version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnge: Fix NULL pointer dereference in aux device release\n\nIf allocation of auxr_dev fails during auxiliary device setup, the error\npath calls auxiliary_device_uninit(), which eventually invokes\nbnge_aux_dev_release().\n\nThe release callback unconditionally dereferences aux_priv-\u003eauxr_dev-\u003epdev\nto retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated\non this failure path, the dereference results in a NULL pointer exception\n\nRetrieve the parent bnge_dev from the auxiliary device\u0027s parent instead of\nauxr_dev, and free auxr_dev only when it was successfully allocated. This\nallows the release callback to correctly clean up partially initialized\nauxiliary devices."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:04.723Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83ef2f3cab7fe6dd9155cd598dc64be524d963a9"
},
{
"url": "https://git.kernel.org/stable/c/1cb4298810e27e037d3ca07286ecbb97e89ba58d"
}
],
"title": "bnge: Fix NULL pointer dereference in aux device release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74706",
"datePublished": "2026-08-22T15:33:04.723Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-22T15:33:04.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74705 (GCVE-0-2026-74705)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
udp: fix potential use-after-free in tunnel segmentation
Summary
In the Linux kernel, the following vulnerability has been resolved:
udp: fix potential use-after-free in tunnel segmentation
__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
Severity
10 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < 6a733a38b983d8c2e222f13968209010cf44de87
(git)
Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < 19d89b13a43640b2da2f277ee462d919d988cb6f (git) Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < b3df61bb745eb5201eac22679a2839d4ccbf3442 (git) Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < 1ae134c012e10384cdac420b5cc6e0615cde0b55 (git) Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < 5161e67c561c4f28a5d9335a6e859b02511de92b (git) Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < 64d322c288577793eedd352b96ef75234ed380fe (git) Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < 588d4a6795d99d080f74ef0b5f391ea8c453ae5d (git) Affected: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 , < d0f86fb36eb260abd10007b62c9dcc1028e03e61 (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6a733a38b983d8c2e222f13968209010cf44de87",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "19d89b13a43640b2da2f277ee462d919d988cb6f",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "b3df61bb745eb5201eac22679a2839d4ccbf3442",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "1ae134c012e10384cdac420b5cc6e0615cde0b55",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "5161e67c561c4f28a5d9335a6e859b02511de92b",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "64d322c288577793eedd352b96ef75234ed380fe",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "588d4a6795d99d080f74ef0b5f391ea8c453ae5d",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "d0f86fb36eb260abd10007b62c9dcc1028e03e61",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote peers reach __skb_udp_tunnel_segment on egress when GRO-coalesced VXLAN/Geneve/FOU GSO superpackets are forwarded or re-encapsulated through dev_queue_xmit, and malicious virtio-net/cloud tenants can inject VIRTIO_NET_HDR_GSO_UDP_TUNNEL frames the host later segments on physical or overlay NICs.\nAC:L - Triggering is deterministic once a GSO UDP-tunnel skb has tunnel headers beyond skb_headlen so pskb_may_pull reallocates skb-\u003ehead; attackers control that layout via fragmented or GRO-built outer/encap headers and can repeat crafted sends until segmentation dereferences the stale UDP pointer.\nPR:N - No host authentication or credentials are required to send UDP tunnel traffic to listening overlay ports on cloud/DC nodes, and co-resident virtio-net guests or tenant VMs can emit GSO UDP-tunnel frames into the host datapath without CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation needs only crafted encapsulated GSO traffic into an already-running overlay, bridge, IPVS, OVS, or virtio forwarding path; no victim file open, mount, link click, or other interactive action beyond normal network or VM I/O.\nS:C - In cloud/Kubernetes and virtio-net multitenant deployments, remote or guest/tenant senders can corrupt hypervisor kernel heap during host-side UDP-tunnel GSO segmentation on egress, crossing the VM/container-to-host security boundary rather than staying within the attacker\u0027s own namespace.\nC:H - After pskb_may_pull reallocates skb-\u003ehead, the pre-pull udp_hdr pointer is stale yet uh-\u003elen and uh-\u003echeck are read for checksum adjustment, yielding a classic heap use-after-free read primitive that can disclose kernel memory and support further exploitation.\nI:H - UAF on the UDP header allows attacker-influenced heap reuse and corruption of header fields and checksum state during tunnel GSO segmentation, providing a write/control primitive suitable for kernel code execution rather than a benign checksum miscalculation.\nA:H - Dereferencing the freed UDP header during GSO segmentation can immediately oops or panic the kernel, and repeated exploitation attempts against this UAF commonly crash or hang the host even when full control is not achieved."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:48.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87"
},
{
"url": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f"
},
{
"url": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442"
},
{
"url": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55"
},
{
"url": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b"
},
{
"url": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe"
},
{
"url": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d"
},
{
"url": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61"
}
],
"title": "udp: fix potential use-after-free in tunnel segmentation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74705",
"datePublished": "2026-08-22T15:33:04.110Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-25T05:41:48.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74704 (GCVE-0-2026-74704)
Vulnerability from nvd – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
EPSS
VEX
Title
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
The sch_cake ACK filter parses packets to find the TCP header and filter
duplicated ACKs if the flow is backlogged. The parsing code contains a
WARN_ON(1) which can be triggered by a malformed IP header in certain
cases. Depending on the system configuration, this leads either to
either spamming dmesg with warnings, or a panic if panic_on_warn is set.
The code already correctly skips the offending packet in the branch that
triggers the warning, so the WARN_ON itself doesn't really serve any
purpose. So just drop it altogether to avoid the inconvenient side
effects.
Severity
8.2 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8b7138814f29933898ecd31dfc83e35a30ee69f5 , < c1693b7844a6c06d31a565e5a494948034dfd235
(git)
Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < a4b52612004a5639c4bfc30ba93ba414b8326e2a (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < 0c4882bff34558d8d53fb04c3e96da5c327c7dc8 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < 2504a76e5c0694e14e15562730e1339f2d9f9458 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < cd2f1d9fe8a507c2dc86ad326fe221f121c47734 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < a1ae353d8355407c1bea971d1c1af5e7f242bb7d (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < 2a33516f9ef59ad11844d4fc152f889449b5daf3 (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_cake.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c1693b7844a6c06d31a565e5a494948034dfd235",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "a4b52612004a5639c4bfc30ba93ba414b8326e2a",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "0c4882bff34558d8d53fb04c3e96da5c327c7dc8",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "2504a76e5c0694e14e15562730e1339f2d9f9458",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "cd2f1d9fe8a507c2dc86ad326fe221f121c47734",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "a1ae353d8355407c1bea971d1c1af5e7f242bb7d",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "2a33516f9ef59ad11844d4fc152f889449b5daf3",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_cake.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn\u0027t really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires in cake_ack_filter() during cake_enqueue() on the packet datapath; remotely sourced traffic through an internet-facing SQM/OpenWrt gateway with CAKE ingress/egress and ack-filter enabled reaches the vulnerable ACK-filter parsing loop without any local syscall or netlink operation by the attacker.\nAC:L - Once CAKE ack-filter is configured, an attacker reliably crafts malformed encapsulated IP headers (e.g., IPv4 carrying an inner header with invalid version) and floods matching TCP ACKs to keep the flow backlogged, deterministically hitting the unsupported-version branch on each qualifying enqueue.\nPR:N - Installing CAKE with ack-filter requires CAP_NET_ADMIN, but triggering the bug on a preconfigured edge router or gateway needs no credentials on the target; an unauthenticated remote peer only sends crafted packets, consistent with CNA precedent for packet-driven tc issues (e.g., CVE-2026-72256).\nUI:N - Exploitation requires only attacker-generated packets delivered through the shaped interface; no victim login, file open, mount, or other interactive action is needed beyond normal network traffic reaching the CAKE-managed path.\nS:U - Impact is confined to kernel traffic-shaping code and warning/panic handling within the affected host; it does not cross VM, container, IOMMU, or other security-authority boundaries.\nC:L - Each WARN_ON(1) emits a kernel backtrace that can disclose kernel text and module pointers via dmesg/syslog to the attacker, constituting limited information disclosure even though no out-of-bounds read or use-after-free occurs.\nI:N - The failure path only executes continue and skips the malformed queued packet; there is no memory corruption, type confusion, or attacker-controlled modification of kernel or network data beyond normal ACK-filter drop behavior.\nA:H - Each matching malformed packet triggers WARN_ON(1) in cake_ack_filter(), flooding kernel warnings and, when panic_on_warn is enabled, invoking check_panic_on_warn() to kernel panic, yielding repeatable denial of service on CAKE-managed router and gateway paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:47.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"
},
{
"url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"
},
{
"url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"
},
{
"url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"
},
{
"url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"
},
{
"url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"
},
{
"url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"
},
{
"url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"
}
],
"title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74704",
"datePublished": "2026-08-22T15:33:03.491Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-25T05:41:47.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}