Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
35326 vulnerabilities by linux
CVE-2026-68454 (GCVE-0-2026-68454)
Vulnerability from nvd – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
KVM: s390: pci: Fix handling of AIF enable without AISB
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix handling of AIF enable without AISB
When a guest seeks to register IRQs without a summary bit specified,
ensure that the associated GAITE then stores 0 for the guest AISB
location instead of virt_to_phys(page_address(NULL)).
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < f887df91826e72b570c5e9298e66dd929f09edde
(git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 3ef3190e30601b2688bdc64169b938b8d7f42010 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < d48b9b096d11e31690c0a4988f65f21b64c01b2a (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < df72596278b0e22dac5ef2881e9221a3a2c4ed11 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 124a3769c43713a11a93a821b313e61ad5110cb8 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 3e3aa6da87d30a0064a17b836685cd43c90a3572 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f887df91826e72b570c5e9298e66dd929f09edde",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "3ef3190e30601b2688bdc64169b938b8d7f42010",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "d48b9b096d11e31690c0a4988f65f21b64c01b2a",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "df72596278b0e22dac5ef2881e9221a3a2c4ed11",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "124a3769c43713a11a93a821b313e61ad5110cb8",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "3e3aa6da87d30a0064a17b836685cd43c90a3572",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix handling of AIF enable without AISB\n\nWhen a guest seeks to register IRQs without a summary bit specified,\nensure that the associated GAITE then stores 0 for the guest AISB\nlocation instead of virt_to_phys(page_address(NULL))."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:57.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f887df91826e72b570c5e9298e66dd929f09edde"
},
{
"url": "https://git.kernel.org/stable/c/3ef3190e30601b2688bdc64169b938b8d7f42010"
},
{
"url": "https://git.kernel.org/stable/c/d48b9b096d11e31690c0a4988f65f21b64c01b2a"
},
{
"url": "https://git.kernel.org/stable/c/df72596278b0e22dac5ef2881e9221a3a2c4ed11"
},
{
"url": "https://git.kernel.org/stable/c/124a3769c43713a11a93a821b313e61ad5110cb8"
},
{
"url": "https://git.kernel.org/stable/c/3e3aa6da87d30a0064a17b836685cd43c90a3572"
}
],
"title": "KVM: s390: pci: Fix handling of AIF enable without AISB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68454",
"datePublished": "2026-08-13T13:59:57.209Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:57.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68453 (GCVE-0-2026-68453)
Vulnerability from nvd – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Add validation of both the actual key buffer size and token length
fields in all the cca_check_sec*token() functions. Additionally check
in cca_gencipherkey() for possible underflow with returned key size.
The CCA token structures contain user-controlled len fields that
were used in operations without proper validation against both the
actual buffer size and minimum token structure size. An attacker
could set this field larger than the actual buffer size, leading to
reading beyond buffer boundaries. This may result in a kernel crash or
exposure of memory via sending this as part of a request down to the
crypto card. Also an attacker could have used a very small len value
and thus enforce a buffer under-run which may produce similar effects
as a over-read.
So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of
sizeof key token struct ... key buf length
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < a57fd7fcdb63e2d5ceac78bbe825ec986062a9da
(git)
Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 3b2abee2a678607ae27975bc6833785c2002df43 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 36b230835b8a008266aad22168ca52afacc8a58d (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_cca.c",
"drivers/s390/crypto/zcrypt_ccamisc.c",
"drivers/s390/crypto/zcrypt_ccamisc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a57fd7fcdb63e2d5ceac78bbe825ec986062a9da",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "3b2abee2a678607ae27975bc6833785c2002df43",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "36b230835b8a008266aad22168ca52afacc8a58d",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_cca.c",
"drivers/s390/crypto/zcrypt_ccamisc.c",
"drivers/s390/crypto/zcrypt_ccamisc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc6",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix buffer over-read in cca_cipher2protkey\n\nAdd validation of both the actual key buffer size and token length\nfields in all the cca_check_sec*token() functions. Additionally check\nin cca_gencipherkey() for possible underflow with returned key size.\n\nThe CCA token structures contain user-controlled len fields that\nwere used in operations without proper validation against both the\nactual buffer size and minimum token structure size. An attacker\ncould set this field larger than the actual buffer size, leading to\nreading beyond buffer boundaries. This may result in a kernel crash or\nexposure of memory via sending this as part of a request down to the\ncrypto card. Also an attacker could have used a very small len value\nand thus enforce a buffer under-run which may produce similar effects\nas a over-read.\n\nSo now a key must\n- key buf length must be at least sizeof the token struct\n- the key len field inside the token must fit into the range of\n sizeof key token struct ... key buf length"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:56.036Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da"
},
{
"url": "https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43"
},
{
"url": "https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d"
}
],
"title": "s390/zcrypt: Fix buffer over-read in cca_cipher2protkey",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68453",
"datePublished": "2026-08-13T13:59:56.036Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:56.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68452 (GCVE-0-2026-68452)
Vulnerability from nvd – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
s390/zcrypt: Validate length for CCA AES cipher key requests
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA AES cipher key requests
cca_cipher2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 406b317ea2b501f6f5eca1264293c9399a73a778
(git)
Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 4fc46deceda076d429ef3fab2ccf8d96629ebd23 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < ad93a1f1a45652478c0cf4eb029114e03af57f3b (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 3859f630b674801a00bca39bc451f52288591f65 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 06afe425d5283b9764303de47f554da5a808ce8a (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "406b317ea2b501f6f5eca1264293c9399a73a778",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "4fc46deceda076d429ef3fab2ccf8d96629ebd23",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "ad93a1f1a45652478c0cf4eb029114e03af57f3b",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "3859f630b674801a00bca39bc451f52288591f65",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "06afe425d5283b9764303de47f554da5a808ce8a",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc6",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA AES cipher key requests\n\ncca_cipher2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:54.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778"
},
{
"url": "https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23"
},
{
"url": "https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b"
},
{
"url": "https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65"
},
{
"url": "https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a"
}
],
"title": "s390/zcrypt: Validate length for CCA AES cipher key requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68452",
"datePublished": "2026-08-13T13:59:54.840Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:54.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68451 (GCVE-0-2026-68451)
Vulnerability from nvd – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
s390/zcrypt: Validate length for CCA ECC private key requests
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA ECC private key requests
cca_ecc2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e
(git)
Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 013a4484f061a2b41f052e25c0015203287e63f1 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 8fa3e9435a13c335efb63fb4f4e77531a0031159 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < a9ae0f6dd45c3ccc1d69363f7aea8af179122730 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "013a4484f061a2b41f052e25c0015203287e63f1",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "8fa3e9435a13c335efb63fb4f4e77531a0031159",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "a9ae0f6dd45c3ccc1d69363f7aea8af179122730",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc6",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA ECC private key requests\n\ncca_ecc2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:53.674Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e"
},
{
"url": "https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5"
},
{
"url": "https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1"
},
{
"url": "https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159"
},
{
"url": "https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730"
}
],
"title": "s390/zcrypt: Validate length for CCA ECC private key requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68451",
"datePublished": "2026-08-13T13:59:53.674Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:53.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68450 (GCVE-0-2026-68450)
Vulnerability from nvd – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
btrfs: free mapping node on duplicate reloc root insert
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: free mapping node on duplicate reloc root insert
__add_reloc_root() allocates a mapping_node before inserting it into
rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it
returns the existing rb_node and leaves the newly allocated node unlinked.
The error path then returns -EEXIST without freeing the new node. Since
the node was never inserted into reloc_root_tree, the later cleanup in
put_reloc_control() cannot find it either.
Free the newly allocated node before returning -EEXIST.
The callers currently assert that -EEXIST should not happen, so this is a
defensive cleanup for an unexpected duplicate insert path. If the path is
ever reached, the local allocation should still be released.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 92bedc0455552b42ada1a1f42b0e3a8593cdfccc
(git)
Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 14a8be9428435ee17f17fae7991215c246b7fd43 (git) Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 797dc567146c7e3c4f8d9680e4fbc76e0a6d9151 (git) Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < ae0629ff9ccb836416ada129f4edc7efea6eaaad (git) Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 6a8269b6459ed870a8156c106a0f597383907872 (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92bedc0455552b42ada1a1f42b0e3a8593cdfccc",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "14a8be9428435ee17f17fae7991215c246b7fd43",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "797dc567146c7e3c4f8d9680e4fbc76e0a6d9151",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "ae0629ff9ccb836416ada129f4edc7efea6eaaad",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "6a8269b6459ed870a8156c106a0f597383907872",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc-\u003ereloc_root_tree. If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\n\nThe error path then returns -EEXIST without freeing the new node. Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\n\nFree the newly allocated node before returning -EEXIST.\n\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path. If the path is\never reached, the local allocation should still be released."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:48.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc"
},
{
"url": "https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43"
},
{
"url": "https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151"
},
{
"url": "https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad"
},
{
"url": "https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872"
}
],
"title": "btrfs: free mapping node on duplicate reloc root insert",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68450",
"datePublished": "2026-08-12T00:51:48.970Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:48.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68449 (GCVE-0-2026-68449)
Vulnerability from nvd – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
The hand-rolled bit-scanning loop in the NCQ completion path has an
infinite loop bug. When tag_mask has only high bits set (e.g.
0x80000000), the inner while loop left-shifts tag_mask until it
overflows to 0. At that point !(0 & 1) is always true and 0 <<= 1
stays 0, causing an infinite loop in hardirq context with a spinlock
held.
Replace the open-coded bit-scanning with __ffs() which correctly
finds the least significant set bit and is bounded by the width of
the argument.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
62936009f35a6659cc3ebe0d90c754182d60da73 , < 4c6e64cae2b2dab32ad9099faa339f6a72c0ce16
(git)
Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < 8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80 (git) Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < 1842d45f461a78988254631893329bdf4596e954 (git) Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < 29b916d3556bd12a95be7c56ca391b8cd572f8be (git) Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < c2130f6553f4a5cbdc259de069600117a995f197 (git) |
|
| Linux | Linux |
Affected:
2.6.36
Unaffected: 0 , < 2.6.36 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/sata_dwc_460ex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c6e64cae2b2dab32ad9099faa339f6a72c0ce16",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "1842d45f461a78988254631893329bdf4596e954",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "29b916d3556bd12a95be7c56ca391b8cd572f8be",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "c2130f6553f4a5cbdc259de069600117a995f197",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/sata_dwc_460ex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning\n\nThe hand-rolled bit-scanning loop in the NCQ completion path has an\ninfinite loop bug. When tag_mask has only high bits set (e.g.\n0x80000000), the inner while loop left-shifts tag_mask until it\noverflows to 0. At that point !(0 \u0026 1) is always true and 0 \u003c\u003c= 1\nstays 0, causing an infinite loop in hardirq context with a spinlock\nheld.\n\nReplace the open-coded bit-scanning with __ffs() which correctly\nfinds the least significant set bit and is bounded by the width of\nthe argument."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:47.140Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c6e64cae2b2dab32ad9099faa339f6a72c0ce16"
},
{
"url": "https://git.kernel.org/stable/c/8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80"
},
{
"url": "https://git.kernel.org/stable/c/1842d45f461a78988254631893329bdf4596e954"
},
{
"url": "https://git.kernel.org/stable/c/29b916d3556bd12a95be7c56ca391b8cd572f8be"
},
{
"url": "https://git.kernel.org/stable/c/c2130f6553f4a5cbdc259de069600117a995f197"
}
],
"title": "ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68449",
"datePublished": "2026-08-12T00:51:47.140Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:47.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68448 (GCVE-0-2026-68448)
Vulnerability from nvd – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
ovl: check access to copy_file_range source with src mounter creds
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovl: check access to copy_file_range source with src mounter creds
Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices")
allowed filesystems that implement the copy_file_range() f_op to decide
if they want to access cross-sb copy from/to the same fs type.
The same commit added checks to verify same sb copy for filesystems that
implement ->copy_file_range() and do not support cross-sb copy at the
time, namely, to ceph, fuse and nfs.
The two remaining fs which implement ->copy_file_range(), cifs and
overlayfs started to support cross-sb copy from this time.
While overlayfs does support cross-sb copy when the two underlying files
are on the same base fs, the copy operation on the two real files from
two different overalyfs filesystems is performed with the mounter
creds of the destination overlayfs and the read permission access hook
for the source file was called with the wrong creds.
This could cause either deny of access to copy which would otherwise be
allowed (e.g. with splice) or allow read access to file which would
otherwise be denied.
Fix the latter case by explicitly verifying read access to source file
with the source overlayfs mounter creds.
The former case remains a quirk of cross-sb overlayfs copy, but
userspace could fall back to regular copy so no harm done.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5dae222a5ff0c269730393018a5539cc970a4726 , < 9ec22c8113d8cf72ed7197bb61037dcad09e50d8
(git)
Affected: 5dae222a5ff0c269730393018a5539cc970a4726 , < 1f4a107439d2e43db176e34919933e617cb7f2c5 (git) Affected: 5dae222a5ff0c269730393018a5539cc970a4726 , < a1e0eb8f55cfe09bb31a202a388babc411292656 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/overlayfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ec22c8113d8cf72ed7197bb61037dcad09e50d8",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "1f4a107439d2e43db176e34919933e617cb7f2c5",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "a1e0eb8f55cfe09bb31a202a388babc411292656",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/overlayfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: check access to copy_file_range source with src mounter creds\n\nCommit 5dae222a5ff0c (\"vfs: allow copy_file_range to copy across devices\")\nallowed filesystems that implement the copy_file_range() f_op to decide\nif they want to access cross-sb copy from/to the same fs type.\n\nThe same commit added checks to verify same sb copy for filesystems that\nimplement -\u003ecopy_file_range() and do not support cross-sb copy at the\ntime, namely, to ceph, fuse and nfs.\n\nThe two remaining fs which implement -\u003ecopy_file_range(), cifs and\noverlayfs started to support cross-sb copy from this time.\n\nWhile overlayfs does support cross-sb copy when the two underlying files\nare on the same base fs, the copy operation on the two real files from\ntwo different overalyfs filesystems is performed with the mounter\ncreds of the destination overlayfs and the read permission access hook\nfor the source file was called with the wrong creds.\n\nThis could cause either deny of access to copy which would otherwise be\nallowed (e.g. with splice) or allow read access to file which would\notherwise be denied.\n\nFix the latter case by explicitly verifying read access to source file\nwith the source overlayfs mounter creds.\n\nThe former case remains a quirk of cross-sb overlayfs copy, but\nuserspace could fall back to regular copy so no harm done."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:44.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ec22c8113d8cf72ed7197bb61037dcad09e50d8"
},
{
"url": "https://git.kernel.org/stable/c/1f4a107439d2e43db176e34919933e617cb7f2c5"
},
{
"url": "https://git.kernel.org/stable/c/a1e0eb8f55cfe09bb31a202a388babc411292656"
}
],
"title": "ovl: check access to copy_file_range source with src mounter creds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68448",
"datePublished": "2026-08-12T00:51:44.866Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:44.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68447 (GCVE-0-2026-68447)
Vulnerability from nvd – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size
from hardware without bounding it to the allocated BO region. If the HW
field is larger than the queue's control stack allocation, memcpy reads
past the BO into adjacent GTT memory and can leak kernel data to userspace.
Store the page-aligned control stack BO size in mqd_manager and clamp
checkpoint copies and reported checkpoint sizes to
min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound
for multi-XCC v9.4.3 checkpoint layout.
(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a0d87beb2660a5098b2b0ecdc1e96810a9074ea9
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 426ffae6ecc7ec77d32bf8be065c21a1b881b084 (git) Affected: 0 , < 7.1.6 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.6 , ≤ 7.1.*
(semver)
Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0d87beb2660a5098b2b0ecdc1e96810a9074ea9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "426ffae6ecc7ec77d32bf8be065c21a1b881b084",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\n\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue\u0027s control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\n\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm-\u003ectl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:42.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9"
},
{
"url": "https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"
}
],
"title": "drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68447",
"datePublished": "2026-08-12T00:51:42.433Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:42.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68446 (GCVE-0-2026-68446)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
drm/vmwgfx: Validate vmw_surface_metadata::array_size
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate vmw_surface_metadata::array_size
This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
504901dbb0b565fcbe466b0c56f3131586df5afd , < 5ff94e1279176b539d451e3e754fdcbd1a8d520a
(git)
Affected: 504901dbb0b565fcbe466b0c56f3131586df5afd , < 71779fe8bf403a9b3e28dc59229fa556db32d35d (git) Affected: 504901dbb0b565fcbe466b0c56f3131586df5afd , < b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8 (git) Affected: 504901dbb0b565fcbe466b0c56f3131586df5afd , < 6910ccaf41678f7761ba2e57d72b77d056320b4d (git) Affected: 504901dbb0b565fcbe466b0c56f3131586df5afd , < a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 (git) |
|
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_surface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ff94e1279176b539d451e3e754fdcbd1a8d520a",
"status": "affected",
"version": "504901dbb0b565fcbe466b0c56f3131586df5afd",
"versionType": "git"
},
{
"lessThan": "71779fe8bf403a9b3e28dc59229fa556db32d35d",
"status": "affected",
"version": "504901dbb0b565fcbe466b0c56f3131586df5afd",
"versionType": "git"
},
{
"lessThan": "b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8",
"status": "affected",
"version": "504901dbb0b565fcbe466b0c56f3131586df5afd",
"versionType": "git"
},
{
"lessThan": "6910ccaf41678f7761ba2e57d72b77d056320b4d",
"status": "affected",
"version": "504901dbb0b565fcbe466b0c56f3131586df5afd",
"versionType": "git"
},
{
"lessThan": "a4f55260f7f7d4dc4d0ee55063dfb0c457b77991",
"status": "affected",
"version": "504901dbb0b565fcbe466b0c56f3131586df5afd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_surface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate vmw_surface_metadata::array_size\n\nThis field comes from userspace and should be validated against specific\nlimits depending on which Shader Model (SM) is available."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:37.385Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ff94e1279176b539d451e3e754fdcbd1a8d520a"
},
{
"url": "https://git.kernel.org/stable/c/71779fe8bf403a9b3e28dc59229fa556db32d35d"
},
{
"url": "https://git.kernel.org/stable/c/b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8"
},
{
"url": "https://git.kernel.org/stable/c/6910ccaf41678f7761ba2e57d72b77d056320b4d"
},
{
"url": "https://git.kernel.org/stable/c/a4f55260f7f7d4dc4d0ee55063dfb0c457b77991"
}
],
"title": "drm/vmwgfx: Validate vmw_surface_metadata::array_size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68446",
"datePublished": "2026-08-12T00:07:37.385Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:07:37.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68445 (GCVE-0-2026-68445)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
drm/vc4: Prevent shader BO mappings from becoming writable
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Prevent shader BO mappings from becoming writable
vc4_gem_object_mmap() rejects a writable mapping of a validated shader
BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and
then turn it writable with mprotect().
Validated shader BOs must stay read-only: the validator checks the
instructions once and the GPU trusts them afterwards. A writable
mapping lets userspace rewrite the code after validation, bypassing the
validator.
Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 already does for its read-only objects.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
463873d5701427f2964a0b4b72c45f1f14b6df87 , < 9f0ee411fc2d76333d6087c5862ffa907cf7a175
(git)
Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 019e6ad247f7fd038d2e009789f6d9bfcccb1ae7 (git) Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 6deaa317201851c644c431b57682e54d06b35838 (git) Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < fe168ef1d232d734d9998fd74822e2e20930dfff (git) Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 0c9e6367639548307d3f578f6943ce72c9d39087 (git) |
|
| Linux | Linux |
Affected:
4.5
Unaffected: 0 , < 4.5 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_bo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9f0ee411fc2d76333d6087c5862ffa907cf7a175",
"status": "affected",
"version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
"versionType": "git"
},
{
"lessThan": "019e6ad247f7fd038d2e009789f6d9bfcccb1ae7",
"status": "affected",
"version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
"versionType": "git"
},
{
"lessThan": "6deaa317201851c644c431b57682e54d06b35838",
"status": "affected",
"version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
"versionType": "git"
},
{
"lessThan": "fe168ef1d232d734d9998fd74822e2e20930dfff",
"status": "affected",
"version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
"versionType": "git"
},
{
"lessThan": "0c9e6367639548307d3f578f6943ce72c9d39087",
"status": "affected",
"version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_bo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Prevent shader BO mappings from becoming writable\n\nvc4_gem_object_mmap() rejects a writable mapping of a validated shader\nBO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and\nthen turn it writable with mprotect().\n\nValidated shader BOs must stay read-only: the validator checks the\ninstructions once and the GPU trusts them afterwards. A writable\nmapping lets userspace rewrite the code after validation, bypassing the\nvalidator.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 already does for its read-only objects."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:36.230Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9f0ee411fc2d76333d6087c5862ffa907cf7a175"
},
{
"url": "https://git.kernel.org/stable/c/019e6ad247f7fd038d2e009789f6d9bfcccb1ae7"
},
{
"url": "https://git.kernel.org/stable/c/6deaa317201851c644c431b57682e54d06b35838"
},
{
"url": "https://git.kernel.org/stable/c/fe168ef1d232d734d9998fd74822e2e20930dfff"
},
{
"url": "https://git.kernel.org/stable/c/0c9e6367639548307d3f578f6943ce72c9d39087"
}
],
"title": "drm/vc4: Prevent shader BO mappings from becoming writable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68445",
"datePublished": "2026-08-12T00:07:36.230Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:36.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68444 (GCVE-0-2026-68444)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
ffa_partition_info_get() passes uuid_str directly to uuid_parse()
without a NULL check. When a caller passes NULL, uuid_parse() ->
__uuid_parse() -> uuid_is_valid() dereferences the pointer, causing
a kernel panic:
| Unable to handle kernel NULL pointer dereference at virtual address
| 0000000000000040
| pc : uuid_parse+0x40/0xac
| lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Add a NULL guard before uuid_parse() so a NULL argument returns
-ENODEV instead of crashing. Callers are expected to always supply
a valid partition UUID, so NULL is not a supported input.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d0c0bce831223b08e5bade2cefc93c3ddb790796 , < 86f5ea90f73bb7154593bb96f3411e197f3d4fbe
(git)
Affected: d0c0bce831223b08e5bade2cefc93c3ddb790796 , < 7201e56e52d18abf4cd0a2fee45daf9dc08b5b97 (git) Affected: d0c0bce831223b08e5bade2cefc93c3ddb790796 , < 996c5c19d5b5ac5b98a7b5a406b548305841c301 (git) Affected: d0c0bce831223b08e5bade2cefc93c3ddb790796 , < 12a42c610e4432e7708cc48d607e5903fffe0aad (git) Affected: d0c0bce831223b08e5bade2cefc93c3ddb790796 , < 8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8 (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86f5ea90f73bb7154593bb96f3411e197f3d4fbe",
"status": "affected",
"version": "d0c0bce831223b08e5bade2cefc93c3ddb790796",
"versionType": "git"
},
{
"lessThan": "7201e56e52d18abf4cd0a2fee45daf9dc08b5b97",
"status": "affected",
"version": "d0c0bce831223b08e5bade2cefc93c3ddb790796",
"versionType": "git"
},
{
"lessThan": "996c5c19d5b5ac5b98a7b5a406b548305841c301",
"status": "affected",
"version": "d0c0bce831223b08e5bade2cefc93c3ddb790796",
"versionType": "git"
},
{
"lessThan": "12a42c610e4432e7708cc48d607e5903fffe0aad",
"status": "affected",
"version": "d0c0bce831223b08e5bade2cefc93c3ddb790796",
"versionType": "git"
},
{
"lessThan": "8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8",
"status": "affected",
"version": "d0c0bce831223b08e5bade2cefc93c3ddb790796",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()\n\nffa_partition_info_get() passes uuid_str directly to uuid_parse()\nwithout a NULL check. When a caller passes NULL, uuid_parse() -\u003e\n__uuid_parse() -\u003e uuid_is_valid() dereferences the pointer, causing\na kernel panic:\n\n | Unable to handle kernel NULL pointer dereference at virtual address\n | 0000000000000040\n | pc : uuid_parse+0x40/0xac\n | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]\n\nAdd a NULL guard before uuid_parse() so a NULL argument returns\n-ENODEV instead of crashing. Callers are expected to always supply\na valid partition UUID, so NULL is not a supported input."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:34.609Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86f5ea90f73bb7154593bb96f3411e197f3d4fbe"
},
{
"url": "https://git.kernel.org/stable/c/7201e56e52d18abf4cd0a2fee45daf9dc08b5b97"
},
{
"url": "https://git.kernel.org/stable/c/996c5c19d5b5ac5b98a7b5a406b548305841c301"
},
{
"url": "https://git.kernel.org/stable/c/12a42c610e4432e7708cc48d607e5903fffe0aad"
},
{
"url": "https://git.kernel.org/stable/c/8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8"
}
],
"title": "firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68444",
"datePublished": "2026-08-12T00:07:34.609Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:34.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68443 (GCVE-0-2026-68443)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
Calling hid_hw_stop() does not stop the device IO.
This results in a race condition between hid_input_report() and the point
immediately following the execution of hid_device_io_start() within
the driver probe function. If the probe operation fails after "io start"
has been initiated, this race condition will result in a UAF vulnerability.
Fix the problem by calling hid_device_io_stop() before calling
hid_hw_stop().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba , < a855f678ba37ef82c4dd22926ad740ecfb8dbedf
(git)
Affected: 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba , < f36e12cc8cfe996d627b8a82bd9df9e43270f6e2 (git) Affected: 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba , < 0842e9faab04f784d01125085195031252ff9695 (git) Affected: 42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba , < ff0c5c53d08274e200b48a4d53aa078265e873cb (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/gigabyte_waterforce.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a855f678ba37ef82c4dd22926ad740ecfb8dbedf",
"status": "affected",
"version": "42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba",
"versionType": "git"
},
{
"lessThan": "f36e12cc8cfe996d627b8a82bd9df9e43270f6e2",
"status": "affected",
"version": "42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba",
"versionType": "git"
},
{
"lessThan": "0842e9faab04f784d01125085195031252ff9695",
"status": "affected",
"version": "42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba",
"versionType": "git"
},
{
"lessThan": "ff0c5c53d08274e200b48a4d53aa078265e873cb",
"status": "affected",
"version": "42ac68e3d4ba06ad17bc56b790dbccc37e76e0ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/gigabyte_waterforce.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop\n\nCalling hid_hw_stop() does not stop the device IO.\nThis results in a race condition between hid_input_report() and the point\nimmediately following the execution of hid_device_io_start() within\nthe driver probe function. If the probe operation fails after \"io start\"\nhas been initiated, this race condition will result in a UAF vulnerability.\n\nFix the problem by calling hid_device_io_stop() before calling\nhid_hw_stop()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:33.319Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a855f678ba37ef82c4dd22926ad740ecfb8dbedf"
},
{
"url": "https://git.kernel.org/stable/c/f36e12cc8cfe996d627b8a82bd9df9e43270f6e2"
},
{
"url": "https://git.kernel.org/stable/c/0842e9faab04f784d01125085195031252ff9695"
},
{
"url": "https://git.kernel.org/stable/c/ff0c5c53d08274e200b48a4d53aa078265e873cb"
}
],
"title": "hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68443",
"datePublished": "2026-08-12T00:07:33.319Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:33.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68442 (GCVE-0-2026-68442)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
When btrfs_drop_extent_map_range() splits an extent map, the new split
maps inherit the original map's flags through a local 'flags' variable.
Commit f86f7a75e2fb ("btrfs: use the flags of an extent map to identify
the compression type") changed the EXTENT_FLAG_LOGGING clearing to
operate on em->flags instead of that local 'flags' copy, so a split of
an extent map that is currently being logged wrongly inherits
EXTENT_FLAG_LOGGING.
The flag is then never cleared on the split, and when it is freed while
still on the inode's modified_extents list (for example by the extent
map shrinker) it trips the WARN_ON(!list_empty(&em->list)) in
btrfs_free_extent_map() and leads to a use-after-free.
Clear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the
splits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the
behaviour prior to f86f7a75e2fb.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 , < 2a9246a424f45f33a1b8367052611ebe874868ad
(git)
Affected: f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 , < 9304713b70e7e1450e3a76e758836fe5391bfa95 (git) Affected: f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 , < 0e465c63f103a5ce6849614d6bda048d70eebec8 (git) Affected: f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 , < 5eff4d5b17fa1950e80bfd1ba43dc0699e61a644 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a9246a424f45f33a1b8367052611ebe874868ad",
"status": "affected",
"version": "f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9",
"versionType": "git"
},
{
"lessThan": "9304713b70e7e1450e3a76e758836fe5391bfa95",
"status": "affected",
"version": "f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9",
"versionType": "git"
},
{
"lessThan": "0e465c63f103a5ce6849614d6bda048d70eebec8",
"status": "affected",
"version": "f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9",
"versionType": "git"
},
{
"lessThan": "5eff4d5b17fa1950e80bfd1ba43dc0699e61a644",
"status": "affected",
"version": "f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don\u0027t propagate EXTENT_FLAG_LOGGING to split extent maps\n\nWhen btrfs_drop_extent_map_range() splits an extent map, the new split\nmaps inherit the original map\u0027s flags through a local \u0027flags\u0027 variable.\nCommit f86f7a75e2fb (\"btrfs: use the flags of an extent map to identify\nthe compression type\") changed the EXTENT_FLAG_LOGGING clearing to\noperate on em-\u003eflags instead of that local \u0027flags\u0027 copy, so a split of\nan extent map that is currently being logged wrongly inherits\nEXTENT_FLAG_LOGGING.\n\nThe flag is then never cleared on the split, and when it is freed while\nstill on the inode\u0027s modified_extents list (for example by the extent\nmap shrinker) it trips the WARN_ON(!list_empty(\u0026em-\u003elist)) in\nbtrfs_free_extent_map() and leads to a use-after-free.\n\nClear EXTENT_FLAG_LOGGING from the local \u0027flags\u0027 copy used for the\nsplits and only clear EXTENT_FLAG_PINNED from em-\u003eflags, restoring the\nbehaviour prior to f86f7a75e2fb."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:31.981Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a9246a424f45f33a1b8367052611ebe874868ad"
},
{
"url": "https://git.kernel.org/stable/c/9304713b70e7e1450e3a76e758836fe5391bfa95"
},
{
"url": "https://git.kernel.org/stable/c/0e465c63f103a5ce6849614d6bda048d70eebec8"
},
{
"url": "https://git.kernel.org/stable/c/5eff4d5b17fa1950e80bfd1ba43dc0699e61a644"
}
],
"title": "btrfs: don\u0027t propagate EXTENT_FLAG_LOGGING to split extent maps",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68442",
"datePublished": "2026-08-12T00:07:31.981Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:31.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68441 (GCVE-0-2026-68441)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
When a TC filter attached to a qdisc filter chain returns
TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an
act_bpf action), the redirect was silently lost i.e no qdisc classify
function handled TC_ACT_REDIRECT, so the packet fell through the
switch and was enqueued normally instead of being redirected.
This has been broken since bpf_redirect() was introduced for TC in
commit 27b29f63058d ("bpf: add bpf_redirect() helper"). We got lucky
for a long time because bpf_net_context was a per-CPU variable that
was always available.
commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct
on PREEMPT_RT.") turned bpf_net_context into a task_struct member that
is only set up by explicit callers. Without a caller setting it up,
bpf_redirect() itself crashes with a NULL pointer dereference in
bpf_net_ctx_get_ri(). However, even with bpf_net_context available,
TC_ACT_REDIRECT from qdisc filter chains cannot be honored without
adding skb_do_redirect() calls to every qdisc classify function, which
would require changes across net/sched/. Isolate it to ebpf core where
it belongs.
Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a
wrapper around tcf_classify() for use by qdisc classify functions and
tcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT,
the wrapper converts it to TC_ACT_SHOT, dropping the packet rather
than letting it continue silently. Dropping is preferred over
letting the packet through because the user immediately sees packet
loss. Silently passing the packet through would hide the problem and
leave the user wondering why their redirect is not working.
The clsact fast path, tc_run() continues to call tcf_classify() directly
and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by
sch_handle_egress/ingress() calling skb_do_redirect() as before.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
27b29f63058d26c6c1742f1993338280d5a41dc6 , < c8fd74445e86f88096d2f6cf0f9e4d54d8ed1781
(git)
Affected: 27b29f63058d26c6c1742f1993338280d5a41dc6 , < ec48b3be2c8595dd290be883dbd4fb8b2f9f5d5e (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/pkt_cls.h",
"net/sched/cls_api.c",
"net/sched/sch_cake.c",
"net/sched/sch_drr.c",
"net/sched/sch_dualpi2.c",
"net/sched/sch_ets.c",
"net/sched/sch_fq_codel.c",
"net/sched/sch_fq_pie.c",
"net/sched/sch_hfsc.c",
"net/sched/sch_htb.c",
"net/sched/sch_multiq.c",
"net/sched/sch_prio.c",
"net/sched/sch_qfq.c",
"net/sched/sch_sfb.c",
"net/sched/sch_sfq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8fd74445e86f88096d2f6cf0f9e4d54d8ed1781",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
},
{
"lessThan": "ec48b3be2c8595dd290be883dbd4fb8b2f9f5d5e",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/pkt_cls.h",
"net/sched/cls_api.c",
"net/sched/sch_cake.c",
"net/sched/sch_drr.c",
"net/sched/sch_dualpi2.c",
"net/sched/sch_ets.c",
"net/sched/sch_fq_codel.c",
"net/sched/sch_fq_pie.c",
"net/sched/sch_hfsc.c",
"net/sched/sch_htb.c",
"net/sched/sch_multiq.c",
"net/sched/sch_prio.c",
"net/sched/sch_qfq.c",
"net/sched/sch_sfb.c",
"net/sched/sch_sfq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Handle TC_ACT_REDIRECT from qdisc filter chains\n\nWhen a TC filter attached to a qdisc filter chain returns\nTC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an\nact_bpf action), the redirect was silently lost i.e no qdisc classify\nfunction handled TC_ACT_REDIRECT, so the packet fell through the\nswitch and was enqueued normally instead of being redirected.\n\nThis has been broken since bpf_redirect() was introduced for TC in\ncommit 27b29f63058d (\"bpf: add bpf_redirect() helper\"). We got lucky\nfor a long time because bpf_net_context was a per-CPU variable that\nwas always available.\n\ncommit 401cb7dae813 (\"net: Reference bpf_redirect_info via task_struct\non PREEMPT_RT.\") turned bpf_net_context into a task_struct member that\nis only set up by explicit callers. Without a caller setting it up,\nbpf_redirect() itself crashes with a NULL pointer dereference in\nbpf_net_ctx_get_ri(). However, even with bpf_net_context available,\nTC_ACT_REDIRECT from qdisc filter chains cannot be honored without\nadding skb_do_redirect() calls to every qdisc classify function, which\nwould require changes across net/sched/. Isolate it to ebpf core where\nit belongs.\n\nInstead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a\nwrapper around tcf_classify() for use by qdisc classify functions and\ntcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT,\nthe wrapper converts it to TC_ACT_SHOT, dropping the packet rather\nthan letting it continue silently. Dropping is preferred over\nletting the packet through because the user immediately sees packet\nloss. Silently passing the packet through would hide the problem and\nleave the user wondering why their redirect is not working.\n\nThe clsact fast path, tc_run() continues to call tcf_classify() directly\nand is unaffected: TC_ACT_REDIRECT is returned as-is and handled by\nsch_handle_egress/ingress() calling skb_do_redirect() as before."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:30.669Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8fd74445e86f88096d2f6cf0f9e4d54d8ed1781"
},
{
"url": "https://git.kernel.org/stable/c/ec48b3be2c8595dd290be883dbd4fb8b2f9f5d5e"
}
],
"title": "net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68441",
"datePublished": "2026-08-12T00:07:30.669Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:30.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68440 (GCVE-0-2026-68440)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
net: txgbe: fix heap overflow when reading module EEPROM
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: txgbe: fix heap overflow when reading module EEPROM
txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes
into the caller buffer, which ethtool allocates with exactly 'length'
bytes. A non-4-aligned length therefore causes an out-of-bounds write.
Copy only the remaining bytes on the final dword instead.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9b97b6b5635b3de18debd07a3adcf25198ec8299 , < febcced6958158e7e90a55a8567b3f5c3639c0b9
(git)
Affected: 9b97b6b5635b3de18debd07a3adcf25198ec8299 , < 6a905a71fd43ce8b45f05044b11491337f232c9d (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "febcced6958158e7e90a55a8567b3f5c3639c0b9",
"status": "affected",
"version": "9b97b6b5635b3de18debd07a3adcf25198ec8299",
"versionType": "git"
},
{
"lessThan": "6a905a71fd43ce8b45f05044b11491337f232c9d",
"status": "affected",
"version": "9b97b6b5635b3de18debd07a3adcf25198ec8299",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix heap overflow when reading module EEPROM\n\ntxgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes\ninto the caller buffer, which ethtool allocates with exactly \u0027length\u0027\nbytes. A non-4-aligned length therefore causes an out-of-bounds write.\nCopy only the remaining bytes on the final dword instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:29.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/febcced6958158e7e90a55a8567b3f5c3639c0b9"
},
{
"url": "https://git.kernel.org/stable/c/6a905a71fd43ce8b45f05044b11491337f232c9d"
}
],
"title": "net: txgbe: fix heap overflow when reading module EEPROM",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68440",
"datePublished": "2026-08-12T00:07:29.605Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:29.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68439 (GCVE-0-2026-68439)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
mt76_connac_get_he_phy_cap routine can theoretically return NULL so
check cap pointer before dereferencing it.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 42288cca984fb72ad3ebe43d4e7fdce9dcabfdb5
(git)
Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 313343ab8cab7417973e7bdd43d3c3e93044b447 (git) Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 856f1588a2590e70b119e76c15315615a36aebc8 (git) Affected: c948b5da6bbec742b433138e3e3f9537a85af2e5 , < 8d1b6738c1ab48c086b17e7994034aca94258931 (git) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42288cca984fb72ad3ebe43d4e7fdce9dcabfdb5",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
},
{
"lessThan": "313343ab8cab7417973e7bdd43d3c3e93044b447",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
},
{
"lessThan": "856f1588a2590e70b119e76c15315615a36aebc8",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
},
{
"lessThan": "8d1b6738c1ab48c086b17e7994034aca94258931",
"status": "affected",
"version": "c948b5da6bbec742b433138e3e3f9537a85af2e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()\n\nmt76_connac_get_he_phy_cap routine can theoretically return NULL so\ncheck cap pointer before dereferencing it."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:28.625Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42288cca984fb72ad3ebe43d4e7fdce9dcabfdb5"
},
{
"url": "https://git.kernel.org/stable/c/313343ab8cab7417973e7bdd43d3c3e93044b447"
},
{
"url": "https://git.kernel.org/stable/c/856f1588a2590e70b119e76c15315615a36aebc8"
},
{
"url": "https://git.kernel.org/stable/c/8d1b6738c1ab48c086b17e7994034aca94258931"
}
],
"title": "wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68439",
"datePublished": "2026-08-12T00:07:28.625Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:28.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68438 (GCVE-0-2026-68438)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
smp: Make CSD lock acquisition atomic for debug mode
Summary
In the Linux kernel, the following vulnerability has been resolved:
smp: Make CSD lock acquisition atomic for debug mode
Commit b0473dcd4b1d ("smp: Improve smp_call_function_single()
CSD-lock diagnostics") changed smp_call_function_single() so that,
when CSD lock debugging is enabled, async !wait calls use the
destination CPU csd_data. That improves diagnostics, but it also removes
the single-writer property that made the old csd_lock() safe: multiple
CPUs can now prepare the same destination CPU CSD concurrently.
csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the
bit with a non-atomic read-modify-write. Two senders can both see an
unlocked CSD, set the bit, overwrite the callback fields, and enqueue
the same llist node. Re-adding a node that is already the queue head can
make node->next point to itself, leaving the target CPU stuck walking
call_single_queue. Later synchronous work, such as a TLB shootdown, can
then remain queued and trigger soft-lockup warnings or panics.
Keep the single csd_lock() implementation, but when CSD lock debugging is
enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the
destination CPU CSD a real atomic lock in the only configuration where it
can be shared by multiple remote senders, while preserving the existing
non-debug fast path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b0473dcd4b1d7e2e44947e7ac1820c73a268821a , < 282d220bae5fbfc90cf0e3d5b5e42c00ad79f989
(git)
Affected: b0473dcd4b1d7e2e44947e7ac1820c73a268821a , < 35551efb155e3b83445a6c3f66cb498d5efc182c (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "282d220bae5fbfc90cf0e3d5b5e42c00ad79f989",
"status": "affected",
"version": "b0473dcd4b1d7e2e44947e7ac1820c73a268821a",
"versionType": "git"
},
{
"lessThan": "35551efb155e3b83445a6c3f66cb498d5efc182c",
"status": "affected",
"version": "b0473dcd4b1d7e2e44947e7ac1820c73a268821a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmp: Make CSD lock acquisition atomic for debug mode\n\nCommit b0473dcd4b1d (\"smp: Improve smp_call_function_single()\nCSD-lock diagnostics\") changed smp_call_function_single() so that,\nwhen CSD lock debugging is enabled, async !wait calls use the\ndestination CPU csd_data. That improves diagnostics, but it also removes\nthe single-writer property that made the old csd_lock() safe: multiple\nCPUs can now prepare the same destination CPU CSD concurrently.\n\ncsd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the\nbit with a non-atomic read-modify-write. Two senders can both see an\nunlocked CSD, set the bit, overwrite the callback fields, and enqueue\nthe same llist node. Re-adding a node that is already the queue head can\nmake node-\u003enext point to itself, leaving the target CPU stuck walking\ncall_single_queue. Later synchronous work, such as a TLB shootdown, can\nthen remain queued and trigger soft-lockup warnings or panics.\n\nKeep the single csd_lock() implementation, but when CSD lock debugging is\nenabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the\ndestination CPU CSD a real atomic lock in the only configuration where it\ncan be shared by multiple remote senders, while preserving the existing\nnon-debug fast path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:27.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/282d220bae5fbfc90cf0e3d5b5e42c00ad79f989"
},
{
"url": "https://git.kernel.org/stable/c/35551efb155e3b83445a6c3f66cb498d5efc182c"
}
],
"title": "smp: Make CSD lock acquisition atomic for debug mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68438",
"datePublished": "2026-08-12T00:07:27.105Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:27.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68437 (GCVE-0-2026-68437)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
drm/imagination: Fit paired fragment job in the correct CCCB
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Fit paired fragment job in the correct CCCB
For geometry jobs with a paired fragment job, at the moment, the
DRM scheduler's prepare_job() callback:
- checks for internal (driver) dependencies for the geometry job;
- calls into pvr_queue_get_paired_frag_job_dep() to check for external
dependencies for the fragment job (the two jobs are submitted together
but the common scheduler code doesn't know about it, so this needs to
be done at this point in time);
- calls into the prepare_job() callback again, but for the fragment job,
to check its internal dependencies as well, passing the fragment job's
drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.
The problem with the last step is that pvr_queue_prepare_job() doesn't
always take the mismatched fragment job and geometry queue into account,
in particular when checking whether there is space for the fragment
command to be submitted, so the code ends up checking for space in the
geometry (i.e. wrong) CCCB.
The rest of the nested prepare_job() callback happens to work fine at
the moment as the other internal dependencies are not relevant for a
paired fragment job.
Move the initialisation of a paired fragment job's done fence and CCCB
fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct
queue from the fragment job itself.
This fixes cases where prepare_job() wrongly assumed that there was
enough space for a paired fragment job in its own CCCB, unblocking
run_job(), which then returned early without writing the full sequence
of commands to the CCCB.
The above lead to kernel warnings such as the following and potentially
job timeouts (depending on waiters on the missing commands):
[ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63
[ 552.421230] Modules linked in:
[ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT
[ 552.421625] Tainted: [W]=WARN
[ 552.421637] Hardware name: Texas Instruments AM625 SK (DT)
[ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]
[ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]
[ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]
[ 552.421923] sp : ffff800084c47650
[ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000
[ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000
[ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008
[ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000
[ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000
[ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
[ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3
[ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008
[ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000
[ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f
[ 552.422316] Call trace:
[ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)
[ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]
[ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr]
[ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]
[ 552.422623] process_one_work+0x520/0x1288
[ 552.422657] worker_thread+0x3f0/0xb3c
[ 552.422679] kthread+0x334/0x3d8
[ 552.422706] ret_from_fork+0x10/0x20
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 15a9863929206911a08b6f62de9c5da6931dbc9e
(git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < e2c29d51c0f65459ae5bbf7ccc302df4c359c473 (git) Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 4ddf82c18ee4b3d14ec7fa002c4039b46c961abc (git) Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 4baf9e70cb756d78dd56419f8baee2978a72d0c3 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/imagination/pvr_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15a9863929206911a08b6f62de9c5da6931dbc9e",
"status": "affected",
"version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
"versionType": "git"
},
{
"lessThan": "e2c29d51c0f65459ae5bbf7ccc302df4c359c473",
"status": "affected",
"version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
"versionType": "git"
},
{
"lessThan": "4ddf82c18ee4b3d14ec7fa002c4039b46c961abc",
"status": "affected",
"version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
"versionType": "git"
},
{
"lessThan": "4baf9e70cb756d78dd56419f8baee2978a72d0c3",
"status": "affected",
"version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/imagination/pvr_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fit paired fragment job in the correct CCCB\n\nFor geometry jobs with a paired fragment job, at the moment, the\nDRM scheduler\u0027s prepare_job() callback:\n\n- checks for internal (driver) dependencies for the geometry job;\n- calls into pvr_queue_get_paired_frag_job_dep() to check for external\n dependencies for the fragment job (the two jobs are submitted together\n but the common scheduler code doesn\u0027t know about it, so this needs to\n be done at this point in time);\n- calls into the prepare_job() callback again, but for the fragment job,\n to check its internal dependencies as well, passing the fragment job\u0027s\n drm_sched_job and the geometry job\u0027s drm_sched_entity / pvr_queue.\n\nThe problem with the last step is that pvr_queue_prepare_job() doesn\u0027t\nalways take the mismatched fragment job and geometry queue into account,\nin particular when checking whether there is space for the fragment\ncommand to be submitted, so the code ends up checking for space in the\ngeometry (i.e. wrong) CCCB.\nThe rest of the nested prepare_job() callback happens to work fine at\nthe moment as the other internal dependencies are not relevant for a\npaired fragment job.\n\nMove the initialisation of a paired fragment job\u0027s done fence and CCCB\nfence to pvr_queue_get_paired_frag_job_dep(), inferring the correct\nqueue from the fragment job itself.\n\nThis fixes cases where prepare_job() wrongly assumed that there was\nenough space for a paired fragment job in its own CCCB, unblocking\nrun_job(), which then returned early without writing the full sequence\nof commands to the CCCB.\n\nThe above lead to kernel warnings such as the following and potentially\njob timeouts (depending on waiters on the missing commands):\n\n [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63\n [ 552.421230] Modules linked in:\n [ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT\n [ 552.421625] Tainted: [W]=WARN\n [ 552.421637] Hardware name: Texas Instruments AM625 SK (DT)\n [ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\n [ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n [ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\n [ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n [ 552.421923] sp : ffff800084c47650\n [ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000\n [ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000\n [ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008\n [ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000\n [ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\n [ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n [ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\n [ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008\n [ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000\n [ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\n [ 552.422316] Call trace:\n [ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\n [ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n [ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr]\n [ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\n [ 552.422623] process_one_work+0x520/0x1288\n [ 552.422657] worker_thread+0x3f0/0xb3c\n [ 552.422679] kthread+0x334/0x3d8\n [ 552.422706] ret_from_fork+0x10/0x20"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:25.745Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15a9863929206911a08b6f62de9c5da6931dbc9e"
},
{
"url": "https://git.kernel.org/stable/c/e2c29d51c0f65459ae5bbf7ccc302df4c359c473"
},
{
"url": "https://git.kernel.org/stable/c/4ddf82c18ee4b3d14ec7fa002c4039b46c961abc"
},
{
"url": "https://git.kernel.org/stable/c/4baf9e70cb756d78dd56419f8baee2978a72d0c3"
}
],
"title": "drm/imagination: Fit paired fragment job in the correct CCCB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68437",
"datePublished": "2026-08-12T00:07:25.745Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:25.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68436 (GCVE-0-2026-68436)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
drm/amd/display: use kvzalloc to allocate struct dc
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use kvzalloc to allocate struct dc
struct dc has grown large over time (most of it the two inlined
dc_scratch_space copies) and now sits close to the page allocator's 4 MiB
contiguous allocation limit. Its actual size is not fixed by the source
alone, it also depends on the compiler and the .config, so it can easily
cross 4 MiB, e.g. with a newer GCC or a config change.
dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the
request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,
so the page allocator warns and returns NULL. dc_create() then fails, DM
init fails and amdgpu probe aborts with -EINVAL:
WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380
dc_create+0x38/0x660 [amdgpu]
amdgpu_dm_init+0x2d9/0x510 [amdgpu]
dm_hw_init+0x1b/0x90 [amdgpu]
amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]
amdgpu_driver_load_kms+0x19/0x80 [amdgpu]
amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]
dc_create() then returns NULL and DM init fails, which aborts the whole
GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block
<dm> failed -22"), leaving the display unusable. The subsequent
amdgpu_irq_put() warnings during teardown are just fallout of unwinding
a half-initialized device.
struct dc is a software-only bookkeeping structure that is never handed
to hardware DMA and is only ever kept as an opaque pointer, so it does
not require physically contiguous memory. Allocate it with kvzalloc()
(and free it with kvfree()) so that the allocator can fall back to
vmalloc() when a contiguous allocation of that size is not available,
which also avoids the MAX_PAGE_ORDER warning entirely.
v2:
- Rebase to amd-staging-drm-next.
(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dbad70d40cad9c5e7586953275287fe7531fb811
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 75050390151a14802be433c3856ddcb483cecd24 (git) Affected: 0 , < 7.1.6 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.6 , ≤ 7.1.*
(semver)
Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dbad70d40cad9c5e7586953275287fe7531fb811",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "75050390151a14802be433c3856ddcb483cecd24",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use kvzalloc to allocate struct dc\n\nstruct dc has grown large over time (most of it the two inlined\ndc_scratch_space copies) and now sits close to the page allocator\u0027s 4 MiB\ncontiguous allocation limit. Its actual size is not fixed by the source\nalone, it also depends on the compiler and the .config, so it can easily\ncross 4 MiB, e.g. with a newer GCC or a config change.\n\ndc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the\nrequest is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,\nso the page allocator warns and returns NULL. dc_create() then fails, DM\ninit fails and amdgpu probe aborts with -EINVAL:\n\n WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380\n dc_create+0x38/0x660 [amdgpu]\n amdgpu_dm_init+0x2d9/0x510 [amdgpu]\n dm_hw_init+0x1b/0x90 [amdgpu]\n amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]\n amdgpu_driver_load_kms+0x19/0x80 [amdgpu]\n amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]\n\ndc_create() then returns NULL and DM init fails, which aborts the whole\nGPU init and makes amdgpu probe fail with -EINVAL (\"hw_init of IP block\n\u003cdm\u003e failed -22\"), leaving the display unusable. The subsequent\namdgpu_irq_put() warnings during teardown are just fallout of unwinding\na half-initialized device.\n\nstruct dc is a software-only bookkeeping structure that is never handed\nto hardware DMA and is only ever kept as an opaque pointer, so it does\nnot require physically contiguous memory. Allocate it with kvzalloc()\n(and free it with kvfree()) so that the allocator can fall back to\nvmalloc() when a contiguous allocation of that size is not available,\nwhich also avoids the MAX_PAGE_ORDER warning entirely.\n\nv2:\n - Rebase to amd-staging-drm-next.\n\n(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:24.698Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dbad70d40cad9c5e7586953275287fe7531fb811"
},
{
"url": "https://git.kernel.org/stable/c/75050390151a14802be433c3856ddcb483cecd24"
}
],
"title": "drm/amd/display: use kvzalloc to allocate struct dc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68436",
"datePublished": "2026-08-12T00:07:24.698Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-08-12T00:07:24.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68435 (GCVE-0-2026-68435)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
LoongArch: Fix address space mismatch in kexec command line lookup
Summary
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Fix address space mismatch in kexec command line lookup
When searching the loaded segments for the "kexec" command line marker,
the kexec_load(2) path (file_mode == 0) passes the user-space segment
buffer straight to strncmp() through a bogus (char __user *) cast. This
dereferences a user pointer in kernel context, which is wrong and is
flagged by sparse:
arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in
argument 2 (different address spaces) @@ expected char const * @@ got
char [noderef] __user *
Here copy the marker-sized prefix of each segment into a small on-stack
buffer with copy_from_user() before comparing, and skip segments that
fault. The subsequent copy_from_user() that stages the full command line
into the safe area is left unchanged.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 , < a94d6726ec8680a2b0c453fc782a543f68a1ea06
(git)
Affected: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 , < 7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7 (git) Affected: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 , < 485ed44db5694d8d2e5027f63ad608e705286f30 (git) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/loongarch/kernel/machine_kexec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a94d6726ec8680a2b0c453fc782a543f68a1ea06",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "485ed44db5694d8d2e5027f63ad608e705286f30",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/loongarch/kernel/machine_kexec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix address space mismatch in kexec command line lookup\n\nWhen searching the loaded segments for the \"kexec\" command line marker,\nthe kexec_load(2) path (file_mode == 0) passes the user-space segment\nbuffer straight to strncmp() through a bogus (char __user *) cast. This\ndereferences a user pointer in kernel context, which is wrong and is\nflagged by sparse:\n\n arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in\n argument 2 (different address spaces) @@ expected char const * @@ got\n char [noderef] __user *\n\nHere copy the marker-sized prefix of each segment into a small on-stack\nbuffer with copy_from_user() before comparing, and skip segments that\nfault. The subsequent copy_from_user() that stages the full command line\ninto the safe area is left unchanged."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:23.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a94d6726ec8680a2b0c453fc782a543f68a1ea06"
},
{
"url": "https://git.kernel.org/stable/c/7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7"
},
{
"url": "https://git.kernel.org/stable/c/485ed44db5694d8d2e5027f63ad608e705286f30"
}
],
"title": "LoongArch: Fix address space mismatch in kexec command line lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68435",
"datePublished": "2026-08-12T00:07:23.359Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-08-12T00:07:23.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68434 (GCVE-0-2026-68434)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected
platforms") replaced the dnv_board setup and exit callbacks with
PTR_IF(false, ...), which evaluates to NULL. However, the three call
sites in mid8250_probe() and mid8250_remove() unconditionally
dereference these function pointers without NULL checks, causing a NULL
pointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon
D (ICX-D/CDF), or Snowridge (SNR) platform.
Fix this by adding the missing NULL checks before calling the setup and
exit callbacks.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
587afb06a5d1dc5092d3d9e9ac3ccf22094d50c6 , < 1096397c31f6bffa95e77bdd18fbca085be83e10
(git)
Affected: 977855894bca4b87afa50d21e3f3e85a5a0e901f , < 600dcd548fb2b00a69f447684f52ba45d5a3540e (git) Affected: 1cd54e217c6e2cdb794a897b2f855e13ffcee586 , < b2a3eeb57ba24f8a0e34a69d40adcc63e5b9ca56 (git) Affected: 9690e8a342632344984af72bc56b7a1fba61e6cb , < 8cbad52ccfa6a7f089cfab34979bc6cc3bff25be (git) Affected: b1b4efea05a56c0995e4702a86d6624b4fdff32f , < 7fb13fd7e9a59a37cd911efff83abe19e3ee029d (git) Affected: 763d61ded752fbb3116efc951eff4363f237b7e0 (git) Affected: c7d190bb07bf4e3b217c69370e94d1b4c80a40ad (git) Affected: 0b3ed3fa227ba778cabed96e7f8d84addb8bdf9c (git) Affected: 6.6.145 , < 6.6.148 (semver) Affected: 6.12.96 , < 6.12.101 (semver) Affected: 6.18.39 , < 6.18.42 (semver) Affected: 7.1.4 , < 7.1.6 (semver) Affected: 5.10.261 , < 5.11 (semver) Affected: 5.15.212 , < 5.16 (semver) Affected: 6.1.178 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
7.2-rc3
Unaffected: 0 , < 7.2-rc3 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1096397c31f6bffa95e77bdd18fbca085be83e10",
"status": "affected",
"version": "587afb06a5d1dc5092d3d9e9ac3ccf22094d50c6",
"versionType": "git"
},
{
"lessThan": "600dcd548fb2b00a69f447684f52ba45d5a3540e",
"status": "affected",
"version": "977855894bca4b87afa50d21e3f3e85a5a0e901f",
"versionType": "git"
},
{
"lessThan": "b2a3eeb57ba24f8a0e34a69d40adcc63e5b9ca56",
"status": "affected",
"version": "1cd54e217c6e2cdb794a897b2f855e13ffcee586",
"versionType": "git"
},
{
"lessThan": "8cbad52ccfa6a7f089cfab34979bc6cc3bff25be",
"status": "affected",
"version": "9690e8a342632344984af72bc56b7a1fba61e6cb",
"versionType": "git"
},
{
"lessThan": "7fb13fd7e9a59a37cd911efff83abe19e3ee029d",
"status": "affected",
"version": "b1b4efea05a56c0995e4702a86d6624b4fdff32f",
"versionType": "git"
},
{
"status": "affected",
"version": "763d61ded752fbb3116efc951eff4363f237b7e0",
"versionType": "git"
},
{
"status": "affected",
"version": "c7d190bb07bf4e3b217c69370e94d1b4c80a40ad",
"versionType": "git"
},
{
"status": "affected",
"version": "0b3ed3fa227ba778cabed96e7f8d84addb8bdf9c",
"versionType": "git"
},
{
"lessThan": "6.6.148",
"status": "affected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThan": "6.12.101",
"status": "affected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThan": "6.18.42",
"status": "affected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThan": "7.1.6",
"status": "affected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.178",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2-rc3"
},
{
"lessThan": "7.2-rc3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.12.96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "7.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "7.2-rc3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.212",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.178",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms\n\nCommit b1b4efea05a5 (\"serial: 8250_mid: Disable DMA for selected\nplatforms\") replaced the dnv_board setup and exit callbacks with\nPTR_IF(false, ...), which evaluates to NULL. However, the three call\nsites in mid8250_probe() and mid8250_remove() unconditionally\ndereference these function pointers without NULL checks, causing a NULL\npointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon\nD (ICX-D/CDF), or Snowridge (SNR) platform.\n\nFix this by adding the missing NULL checks before calling the setup and\nexit callbacks."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:21.897Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1096397c31f6bffa95e77bdd18fbca085be83e10"
},
{
"url": "https://git.kernel.org/stable/c/600dcd548fb2b00a69f447684f52ba45d5a3540e"
},
{
"url": "https://git.kernel.org/stable/c/b2a3eeb57ba24f8a0e34a69d40adcc63e5b9ca56"
},
{
"url": "https://git.kernel.org/stable/c/8cbad52ccfa6a7f089cfab34979bc6cc3bff25be"
},
{
"url": "https://git.kernel.org/stable/c/7fb13fd7e9a59a37cd911efff83abe19e3ee029d"
}
],
"title": "serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68434",
"datePublished": "2026-08-12T00:07:21.897Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-08-12T00:07:21.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68433 (GCVE-0-2026-68433)
Vulnerability from nvd – Published: 2026-08-12 00:07 – Updated: 2026-08-12 00:07
VLAI
EPSS
VEX
Title
libceph: bound get_version reply decode to front len
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound get_version reply decode to front len
handle_get_version_reply() uses msg->front_alloc_len as the decode
boundary for MON_GET_VERSION_REPLY. That is the size of the reused
reply buffer, not the number of bytes actually received.
A truncated reply can therefore pass ceph_decode_need() and decode the
second u64 from stale tail bytes left in the buffer by an earlier
message, causing an uninitialized memory read.
Use msg->front.iov_len as the receive-side decode boundary, matching
other libceph reply handlers and limiting decoding to the bytes that
were actually read from the wire.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 340e0386aa39da181015bee38f309018c335ce16
(git)
Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < d60de8253c85a02d0e6194b0735e7a562981a04c (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 4e7ebfaa0d14cf50e44041bfde38070d6dbc019f (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < 0d934c934ec746d53fc7e4f53239792647bbae63 (git) Affected: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 , < d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0 (git) |
|
| Linux | Linux |
Affected:
3.16
Unaffected: 0 , < 3.16 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "340e0386aa39da181015bee38f309018c335ce16",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d60de8253c85a02d0e6194b0735e7a562981a04c",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "0d934c934ec746d53fc7e4f53239792647bbae63",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound get_version reply decode to front len\n\nhandle_get_version_reply() uses msg-\u003efront_alloc_len as the decode\nboundary for MON_GET_VERSION_REPLY. That is the size of the reused\nreply buffer, not the number of bytes actually received.\n\nA truncated reply can therefore pass ceph_decode_need() and decode the\nsecond u64 from stale tail bytes left in the buffer by an earlier\nmessage, causing an uninitialized memory read.\n\nUse msg-\u003efront.iov_len as the receive-side decode boundary, matching\nother libceph reply handlers and limiting decoding to the bytes that\nwere actually read from the wire."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:07:20.455Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16"
},
{
"url": "https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c"
},
{
"url": "https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f"
},
{
"url": "https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63"
},
{
"url": "https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0"
}
],
"title": "libceph: bound get_version reply decode to front len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68433",
"datePublished": "2026-08-12T00:07:20.455Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-08-12T00:07:20.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68454 (GCVE-0-2026-68454)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
KVM: s390: pci: Fix handling of AIF enable without AISB
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix handling of AIF enable without AISB
When a guest seeks to register IRQs without a summary bit specified,
ensure that the associated GAITE then stores 0 for the guest AISB
location instead of virt_to_phys(page_address(NULL)).
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < f887df91826e72b570c5e9298e66dd929f09edde
(git)
Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 3ef3190e30601b2688bdc64169b938b8d7f42010 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < d48b9b096d11e31690c0a4988f65f21b64c01b2a (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < df72596278b0e22dac5ef2881e9221a3a2c4ed11 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 124a3769c43713a11a93a821b313e61ad5110cb8 (git) Affected: 3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc , < 3e3aa6da87d30a0064a17b836685cd43c90a3572 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f887df91826e72b570c5e9298e66dd929f09edde",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "3ef3190e30601b2688bdc64169b938b8d7f42010",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "d48b9b096d11e31690c0a4988f65f21b64c01b2a",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "df72596278b0e22dac5ef2881e9221a3a2c4ed11",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "124a3769c43713a11a93a821b313e61ad5110cb8",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
},
{
"lessThan": "3e3aa6da87d30a0064a17b836685cd43c90a3572",
"status": "affected",
"version": "3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix handling of AIF enable without AISB\n\nWhen a guest seeks to register IRQs without a summary bit specified,\nensure that the associated GAITE then stores 0 for the guest AISB\nlocation instead of virt_to_phys(page_address(NULL))."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:57.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f887df91826e72b570c5e9298e66dd929f09edde"
},
{
"url": "https://git.kernel.org/stable/c/3ef3190e30601b2688bdc64169b938b8d7f42010"
},
{
"url": "https://git.kernel.org/stable/c/d48b9b096d11e31690c0a4988f65f21b64c01b2a"
},
{
"url": "https://git.kernel.org/stable/c/df72596278b0e22dac5ef2881e9221a3a2c4ed11"
},
{
"url": "https://git.kernel.org/stable/c/124a3769c43713a11a93a821b313e61ad5110cb8"
},
{
"url": "https://git.kernel.org/stable/c/3e3aa6da87d30a0064a17b836685cd43c90a3572"
}
],
"title": "KVM: s390: pci: Fix handling of AIF enable without AISB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68454",
"datePublished": "2026-08-13T13:59:57.209Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:57.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68453 (GCVE-0-2026-68453)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Add validation of both the actual key buffer size and token length
fields in all the cca_check_sec*token() functions. Additionally check
in cca_gencipherkey() for possible underflow with returned key size.
The CCA token structures contain user-controlled len fields that
were used in operations without proper validation against both the
actual buffer size and minimum token structure size. An attacker
could set this field larger than the actual buffer size, leading to
reading beyond buffer boundaries. This may result in a kernel crash or
exposure of memory via sending this as part of a request down to the
crypto card. Also an attacker could have used a very small len value
and thus enforce a buffer under-run which may produce similar effects
as a over-read.
So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of
sizeof key token struct ... key buf length
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < a57fd7fcdb63e2d5ceac78bbe825ec986062a9da
(git)
Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 3b2abee2a678607ae27975bc6833785c2002df43 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 36b230835b8a008266aad22168ca52afacc8a58d (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_cca.c",
"drivers/s390/crypto/zcrypt_ccamisc.c",
"drivers/s390/crypto/zcrypt_ccamisc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a57fd7fcdb63e2d5ceac78bbe825ec986062a9da",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "3b2abee2a678607ae27975bc6833785c2002df43",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "36b230835b8a008266aad22168ca52afacc8a58d",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_cca.c",
"drivers/s390/crypto/zcrypt_ccamisc.c",
"drivers/s390/crypto/zcrypt_ccamisc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc6",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix buffer over-read in cca_cipher2protkey\n\nAdd validation of both the actual key buffer size and token length\nfields in all the cca_check_sec*token() functions. Additionally check\nin cca_gencipherkey() for possible underflow with returned key size.\n\nThe CCA token structures contain user-controlled len fields that\nwere used in operations without proper validation against both the\nactual buffer size and minimum token structure size. An attacker\ncould set this field larger than the actual buffer size, leading to\nreading beyond buffer boundaries. This may result in a kernel crash or\nexposure of memory via sending this as part of a request down to the\ncrypto card. Also an attacker could have used a very small len value\nand thus enforce a buffer under-run which may produce similar effects\nas a over-read.\n\nSo now a key must\n- key buf length must be at least sizeof the token struct\n- the key len field inside the token must fit into the range of\n sizeof key token struct ... key buf length"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:56.036Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da"
},
{
"url": "https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43"
},
{
"url": "https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d"
}
],
"title": "s390/zcrypt: Fix buffer over-read in cca_cipher2protkey",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68453",
"datePublished": "2026-08-13T13:59:56.036Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:56.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68452 (GCVE-0-2026-68452)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
s390/zcrypt: Validate length for CCA AES cipher key requests
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA AES cipher key requests
cca_cipher2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 406b317ea2b501f6f5eca1264293c9399a73a778
(git)
Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 4fc46deceda076d429ef3fab2ccf8d96629ebd23 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < ad93a1f1a45652478c0cf4eb029114e03af57f3b (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 3859f630b674801a00bca39bc451f52288591f65 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 06afe425d5283b9764303de47f554da5a808ce8a (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "406b317ea2b501f6f5eca1264293c9399a73a778",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "4fc46deceda076d429ef3fab2ccf8d96629ebd23",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "ad93a1f1a45652478c0cf4eb029114e03af57f3b",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "3859f630b674801a00bca39bc451f52288591f65",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "06afe425d5283b9764303de47f554da5a808ce8a",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc6",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA AES cipher key requests\n\ncca_cipher2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:54.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778"
},
{
"url": "https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23"
},
{
"url": "https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b"
},
{
"url": "https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65"
},
{
"url": "https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a"
}
],
"title": "s390/zcrypt: Validate length for CCA AES cipher key requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68452",
"datePublished": "2026-08-13T13:59:54.840Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:54.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68451 (GCVE-0-2026-68451)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:59 – Updated: 2026-08-13 13:59
VLAI
EPSS
VEX
Title
s390/zcrypt: Validate length for CCA ECC private key requests
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA ECC private key requests
cca_ecc2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e
(git)
Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 013a4484f061a2b41f052e25c0015203287e63f1 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 8fa3e9435a13c335efb63fb4f4e77531a0031159 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < a9ae0f6dd45c3ccc1d69363f7aea8af179122730 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "013a4484f061a2b41f052e25c0015203287e63f1",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "8fa3e9435a13c335efb63fb4f4e77531a0031159",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "a9ae0f6dd45c3ccc1d69363f7aea8af179122730",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc6",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA ECC private key requests\n\ncca_ecc2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:59:53.674Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e"
},
{
"url": "https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5"
},
{
"url": "https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1"
},
{
"url": "https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159"
},
{
"url": "https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730"
}
],
"title": "s390/zcrypt: Validate length for CCA ECC private key requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68451",
"datePublished": "2026-08-13T13:59:53.674Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-13T13:59:53.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68450 (GCVE-0-2026-68450)
Vulnerability from cvelistv5 – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
btrfs: free mapping node on duplicate reloc root insert
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: free mapping node on duplicate reloc root insert
__add_reloc_root() allocates a mapping_node before inserting it into
rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it
returns the existing rb_node and leaves the newly allocated node unlinked.
The error path then returns -EEXIST without freeing the new node. Since
the node was never inserted into reloc_root_tree, the later cleanup in
put_reloc_control() cannot find it either.
Free the newly allocated node before returning -EEXIST.
The callers currently assert that -EEXIST should not happen, so this is a
defensive cleanup for an unexpected duplicate insert path. If the path is
ever reached, the local allocation should still be released.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 92bedc0455552b42ada1a1f42b0e3a8593cdfccc
(git)
Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 14a8be9428435ee17f17fae7991215c246b7fd43 (git) Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 797dc567146c7e3c4f8d9680e4fbc76e0a6d9151 (git) Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < ae0629ff9ccb836416ada129f4edc7efea6eaaad (git) Affected: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 , < 6a8269b6459ed870a8156c106a0f597383907872 (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92bedc0455552b42ada1a1f42b0e3a8593cdfccc",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "14a8be9428435ee17f17fae7991215c246b7fd43",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "797dc567146c7e3c4f8d9680e4fbc76e0a6d9151",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "ae0629ff9ccb836416ada129f4edc7efea6eaaad",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "6a8269b6459ed870a8156c106a0f597383907872",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc-\u003ereloc_root_tree. If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\n\nThe error path then returns -EEXIST without freeing the new node. Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\n\nFree the newly allocated node before returning -EEXIST.\n\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path. If the path is\never reached, the local allocation should still be released."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:48.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc"
},
{
"url": "https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43"
},
{
"url": "https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151"
},
{
"url": "https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad"
},
{
"url": "https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872"
}
],
"title": "btrfs: free mapping node on duplicate reloc root insert",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68450",
"datePublished": "2026-08-12T00:51:48.970Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:48.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68449 (GCVE-0-2026-68449)
Vulnerability from cvelistv5 – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
The hand-rolled bit-scanning loop in the NCQ completion path has an
infinite loop bug. When tag_mask has only high bits set (e.g.
0x80000000), the inner while loop left-shifts tag_mask until it
overflows to 0. At that point !(0 & 1) is always true and 0 <<= 1
stays 0, causing an infinite loop in hardirq context with a spinlock
held.
Replace the open-coded bit-scanning with __ffs() which correctly
finds the least significant set bit and is bounded by the width of
the argument.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
62936009f35a6659cc3ebe0d90c754182d60da73 , < 4c6e64cae2b2dab32ad9099faa339f6a72c0ce16
(git)
Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < 8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80 (git) Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < 1842d45f461a78988254631893329bdf4596e954 (git) Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < 29b916d3556bd12a95be7c56ca391b8cd572f8be (git) Affected: 62936009f35a6659cc3ebe0d90c754182d60da73 , < c2130f6553f4a5cbdc259de069600117a995f197 (git) |
|
| Linux | Linux |
Affected:
2.6.36
Unaffected: 0 , < 2.6.36 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/sata_dwc_460ex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c6e64cae2b2dab32ad9099faa339f6a72c0ce16",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "1842d45f461a78988254631893329bdf4596e954",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "29b916d3556bd12a95be7c56ca391b8cd572f8be",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
},
{
"lessThan": "c2130f6553f4a5cbdc259de069600117a995f197",
"status": "affected",
"version": "62936009f35a6659cc3ebe0d90c754182d60da73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/sata_dwc_460ex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning\n\nThe hand-rolled bit-scanning loop in the NCQ completion path has an\ninfinite loop bug. When tag_mask has only high bits set (e.g.\n0x80000000), the inner while loop left-shifts tag_mask until it\noverflows to 0. At that point !(0 \u0026 1) is always true and 0 \u003c\u003c= 1\nstays 0, causing an infinite loop in hardirq context with a spinlock\nheld.\n\nReplace the open-coded bit-scanning with __ffs() which correctly\nfinds the least significant set bit and is bounded by the width of\nthe argument."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:47.140Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c6e64cae2b2dab32ad9099faa339f6a72c0ce16"
},
{
"url": "https://git.kernel.org/stable/c/8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80"
},
{
"url": "https://git.kernel.org/stable/c/1842d45f461a78988254631893329bdf4596e954"
},
{
"url": "https://git.kernel.org/stable/c/29b916d3556bd12a95be7c56ca391b8cd572f8be"
},
{
"url": "https://git.kernel.org/stable/c/c2130f6553f4a5cbdc259de069600117a995f197"
}
],
"title": "ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68449",
"datePublished": "2026-08-12T00:51:47.140Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:47.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68448 (GCVE-0-2026-68448)
Vulnerability from cvelistv5 – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
ovl: check access to copy_file_range source with src mounter creds
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovl: check access to copy_file_range source with src mounter creds
Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices")
allowed filesystems that implement the copy_file_range() f_op to decide
if they want to access cross-sb copy from/to the same fs type.
The same commit added checks to verify same sb copy for filesystems that
implement ->copy_file_range() and do not support cross-sb copy at the
time, namely, to ceph, fuse and nfs.
The two remaining fs which implement ->copy_file_range(), cifs and
overlayfs started to support cross-sb copy from this time.
While overlayfs does support cross-sb copy when the two underlying files
are on the same base fs, the copy operation on the two real files from
two different overalyfs filesystems is performed with the mounter
creds of the destination overlayfs and the read permission access hook
for the source file was called with the wrong creds.
This could cause either deny of access to copy which would otherwise be
allowed (e.g. with splice) or allow read access to file which would
otherwise be denied.
Fix the latter case by explicitly verifying read access to source file
with the source overlayfs mounter creds.
The former case remains a quirk of cross-sb overlayfs copy, but
userspace could fall back to regular copy so no harm done.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5dae222a5ff0c269730393018a5539cc970a4726 , < 9ec22c8113d8cf72ed7197bb61037dcad09e50d8
(git)
Affected: 5dae222a5ff0c269730393018a5539cc970a4726 , < 1f4a107439d2e43db176e34919933e617cb7f2c5 (git) Affected: 5dae222a5ff0c269730393018a5539cc970a4726 , < a1e0eb8f55cfe09bb31a202a388babc411292656 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/overlayfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ec22c8113d8cf72ed7197bb61037dcad09e50d8",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "1f4a107439d2e43db176e34919933e617cb7f2c5",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "a1e0eb8f55cfe09bb31a202a388babc411292656",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/overlayfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc5",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: check access to copy_file_range source with src mounter creds\n\nCommit 5dae222a5ff0c (\"vfs: allow copy_file_range to copy across devices\")\nallowed filesystems that implement the copy_file_range() f_op to decide\nif they want to access cross-sb copy from/to the same fs type.\n\nThe same commit added checks to verify same sb copy for filesystems that\nimplement -\u003ecopy_file_range() and do not support cross-sb copy at the\ntime, namely, to ceph, fuse and nfs.\n\nThe two remaining fs which implement -\u003ecopy_file_range(), cifs and\noverlayfs started to support cross-sb copy from this time.\n\nWhile overlayfs does support cross-sb copy when the two underlying files\nare on the same base fs, the copy operation on the two real files from\ntwo different overalyfs filesystems is performed with the mounter\ncreds of the destination overlayfs and the read permission access hook\nfor the source file was called with the wrong creds.\n\nThis could cause either deny of access to copy which would otherwise be\nallowed (e.g. with splice) or allow read access to file which would\notherwise be denied.\n\nFix the latter case by explicitly verifying read access to source file\nwith the source overlayfs mounter creds.\n\nThe former case remains a quirk of cross-sb overlayfs copy, but\nuserspace could fall back to regular copy so no harm done."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:44.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ec22c8113d8cf72ed7197bb61037dcad09e50d8"
},
{
"url": "https://git.kernel.org/stable/c/1f4a107439d2e43db176e34919933e617cb7f2c5"
},
{
"url": "https://git.kernel.org/stable/c/a1e0eb8f55cfe09bb31a202a388babc411292656"
}
],
"title": "ovl: check access to copy_file_range source with src mounter creds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68448",
"datePublished": "2026-08-12T00:51:44.866Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:44.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68447 (GCVE-0-2026-68447)
Vulnerability from cvelistv5 – Published: 2026-08-12 00:51 – Updated: 2026-08-12 00:51
VLAI
EPSS
VEX
Title
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size
from hardware without bounding it to the allocated BO region. If the HW
field is larger than the queue's control stack allocation, memcpy reads
past the BO into adjacent GTT memory and can leak kernel data to userspace.
Store the page-aligned control stack BO size in mqd_manager and clamp
checkpoint copies and reported checkpoint sizes to
min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound
for multi-XCC v9.4.3 checkpoint layout.
(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a0d87beb2660a5098b2b0ecdc1e96810a9074ea9
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 426ffae6ecc7ec77d32bf8be065c21a1b881b084 (git) Affected: 0 , < 7.1.6 (semver) |
|
| Linux | Linux |
Unaffected:
7.1.6 , ≤ 7.1.*
(semver)
Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0d87beb2660a5098b2b0ecdc1e96810a9074ea9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "426ffae6ecc7ec77d32bf8be065c21a1b881b084",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\n\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue\u0027s control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\n\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm-\u003ectl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T00:51:42.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9"
},
{
"url": "https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"
}
],
"title": "drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68447",
"datePublished": "2026-08-12T00:51:42.433Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-12T00:51:42.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}