CVE-2026-23192 (GCVE-0-2026-23192)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-04-03 13:32
VLAI?
Title
linkwatch: use __dev_put() in callers to prevent UAF
Summary
In the Linux kernel, the following vulnerability has been resolved: linkwatch: use __dev_put() in callers to prevent UAF After linkwatch_do_dev() calls __dev_put() to release the linkwatch reference, the device refcount may drop to 1. At this point, netdev_run_todo() can proceed (since linkwatch_sync_dev() sees an empty list and returns without blocking), wait for the refcount to become 1 via netdev_wait_allrefs_any(), and then free the device via kobject_put(). This creates a use-after-free when __linkwatch_run_queue() tries to call netdev_unlock_ops() on the already-freed device. Note that adding netdev_lock_ops()/netdev_unlock_ops() pair in netdev_run_todo() before kobject_put() would not work, because netdev_lock_ops() is conditional - it only locks when netdev_need_ops_lock() returns true. If the device doesn't require ops_lock, linkwatch won't hold any lock, and netdev_run_todo() acquiring the lock won't provide synchronization. Fix this by moving __dev_put() from linkwatch_do_dev() to its callers. The device reference logically pairs with de-listing the device, so it's reasonable for the caller that did the de-listing to release it. This allows placing __dev_put() after all device accesses are complete, preventing UAF. The bug can be reproduced by adding mdelay(2000) after linkwatch_do_dev() in __linkwatch_run_queue(), then running: ip tuntap add mode tun name tun_test ip link set tun_test up ip link set tun_test carrier off ip link set tun_test carrier on sleep 0.5 ip tuntap del mode tun name tun_test KASAN report: ================================================================== BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline] BUG: KASAN: use-after-free in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245 Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123 CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events_unbound linkwatch_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x156/0x4c9 mm/kasan/report.c:482 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595 netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] netdev_unlock_ops include/net/netdev_lock.h:47 [inline] __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> ==================================================================
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 04efcee6ef8d0f01eef495db047e7216d6e6e38f , < 2718ae6af7445ba2ee0abf6365ca43a9a3b16aeb (git)
Affected: 04efcee6ef8d0f01eef495db047e7216d6e6e38f , < 83b67cc9be9223183caf91826d9c194d7fb128fa (git)
Create a notification for this product.
    Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/link_watch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2718ae6af7445ba2ee0abf6365ca43a9a3b16aeb",
              "status": "affected",
              "version": "04efcee6ef8d0f01eef495db047e7216d6e6e38f",
              "versionType": "git"
            },
            {
              "lessThan": "83b67cc9be9223183caf91826d9c194d7fb128fa",
              "status": "affected",
              "version": "04efcee6ef8d0f01eef495db047e7216d6e6e38f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/link_watch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlinkwatch: use __dev_put() in callers to prevent UAF\n\nAfter linkwatch_do_dev() calls __dev_put() to release the linkwatch\nreference, the device refcount may drop to 1. At this point,\nnetdev_run_todo() can proceed (since linkwatch_sync_dev() sees an\nempty list and returns without blocking), wait for the refcount to\nbecome 1 via netdev_wait_allrefs_any(), and then free the device\nvia kobject_put().\n\nThis creates a use-after-free when __linkwatch_run_queue() tries to\ncall netdev_unlock_ops() on the already-freed device.\n\nNote that adding netdev_lock_ops()/netdev_unlock_ops() pair in\nnetdev_run_todo() before kobject_put() would not work, because\nnetdev_lock_ops() is conditional - it only locks when\nnetdev_need_ops_lock() returns true. If the device doesn\u0027t require\nops_lock, linkwatch won\u0027t hold any lock, and netdev_run_todo()\nacquiring the lock won\u0027t provide synchronization.\n\nFix this by moving __dev_put() from linkwatch_do_dev() to its\ncallers. The device reference logically pairs with de-listing the\ndevice, so it\u0027s reasonable for the caller that did the de-listing\nto release it. This allows placing __dev_put() after all device\naccesses are complete, preventing UAF.\n\nThe bug can be reproduced by adding mdelay(2000) after\nlinkwatch_do_dev() in __linkwatch_run_queue(), then running:\n\n  ip tuntap add mode tun name tun_test\n  ip link set tun_test up\n  ip link set tun_test carrier off\n  ip link set tun_test carrier on\n  sleep 0.5\n  ip tuntap del mode tun name tun_test\n\nKASAN report:\n\n ==================================================================\n BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]\n BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline]\n BUG: KASAN: use-after-free in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245\n Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123\n\n CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: events_unbound linkwatch_event\n Call Trace:\n  \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0x156/0x4c9 mm/kasan/report.c:482\n  kasan_report+0xdf/0x1a0 mm/kasan/report.c:595\n  netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]\n  netdev_unlock_ops include/net/netdev_lock.h:47 [inline]\n  __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245\n  linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304\n  process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257\n  process_scheduled_works kernel/workqueue.c:3340 [inline]\n  worker_thread+0x5da/0xe40 kernel/workqueue.c:3421\n  kthread+0x3b3/0x730 kernel/kthread.c:463\n  ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n  \u003c/TASK\u003e\n =================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T13:32:24.568Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2718ae6af7445ba2ee0abf6365ca43a9a3b16aeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/83b67cc9be9223183caf91826d9c194d7fb128fa"
        }
      ],
      "title": "linkwatch: use __dev_put() in callers to prevent UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23192",
    "datePublished": "2026-02-14T16:27:19.557Z",
    "dateReserved": "2026-01-13T15:37:45.985Z",
    "dateUpdated": "2026-04-03T13:32:24.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23192\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:57.020\",\"lastModified\":\"2026-04-03T14:16:26.533\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlinkwatch: use __dev_put() in callers to prevent UAF\\n\\nAfter linkwatch_do_dev() calls __dev_put() to release the linkwatch\\nreference, the device refcount may drop to 1. At this point,\\nnetdev_run_todo() can proceed (since linkwatch_sync_dev() sees an\\nempty list and returns without blocking), wait for the refcount to\\nbecome 1 via netdev_wait_allrefs_any(), and then free the device\\nvia kobject_put().\\n\\nThis creates a use-after-free when __linkwatch_run_queue() tries to\\ncall netdev_unlock_ops() on the already-freed device.\\n\\nNote that adding netdev_lock_ops()/netdev_unlock_ops() pair in\\nnetdev_run_todo() before kobject_put() would not work, because\\nnetdev_lock_ops() is conditional - it only locks when\\nnetdev_need_ops_lock() returns true. If the device doesn\u0027t require\\nops_lock, linkwatch won\u0027t hold any lock, and netdev_run_todo()\\nacquiring the lock won\u0027t provide synchronization.\\n\\nFix this by moving __dev_put() from linkwatch_do_dev() to its\\ncallers. The device reference logically pairs with de-listing the\\ndevice, so it\u0027s reasonable for the caller that did the de-listing\\nto release it. This allows placing __dev_put() after all device\\naccesses are complete, preventing UAF.\\n\\nThe bug can be reproduced by adding mdelay(2000) after\\nlinkwatch_do_dev() in __linkwatch_run_queue(), then running:\\n\\n  ip tuntap add mode tun name tun_test\\n  ip link set tun_test up\\n  ip link set tun_test carrier off\\n  ip link set tun_test carrier on\\n  sleep 0.5\\n  ip tuntap del mode tun name tun_test\\n\\nKASAN report:\\n\\n ==================================================================\\n BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]\\n BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline]\\n BUG: KASAN: use-after-free in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245\\n Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123\\n\\n CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full)\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n Workqueue: events_unbound linkwatch_event\\n Call Trace:\\n  \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:94 [inline]\\n  dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\\n  print_address_description mm/kasan/report.c:378 [inline]\\n  print_report+0x156/0x4c9 mm/kasan/report.c:482\\n  kasan_report+0xdf/0x1a0 mm/kasan/report.c:595\\n  netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]\\n  netdev_unlock_ops include/net/netdev_lock.h:47 [inline]\\n  __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245\\n  linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304\\n  process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257\\n  process_scheduled_works kernel/workqueue.c:3340 [inline]\\n  worker_thread+0x5da/0xe40 kernel/workqueue.c:3421\\n  kthread+0x3b3/0x730 kernel/kthread.c:463\\n  ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\\n  \u003c/TASK\u003e\\n ==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nlinkwatch: usar __dev_put() en las funciones que llaman para prevenir UAF\\n\\nDespu\u00e9s de que linkwatch_do_dev() llama a __dev_put() para liberar la referencia de linkwatch, el contador de referencias del dispositivo puede bajar a 1. En este punto, netdev_run_todo() puede continuar (ya que linkwatch_sync_dev() ve una lista vac\u00eda y regresa sin bloquear), esperar a que el contador de referencias llegue a 1 a trav\u00e9s de netdev_wait_allrefs_any(), y luego liberar el dispositivo a trav\u00e9s de kobject_put().\\n\\nEsto crea un uso despu\u00e9s de liberaci\u00f3n cuando __linkwatch_run_queue() intenta llamar a netdev_unlock_ops() en el dispositivo ya liberado.\\n\\nTenga en cuenta que a\u00f1adir el par netdev_lock_ops()/netdev_unlock_ops() en netdev_run_todo() antes de kobject_put() no funcionar\u00eda, porque netdev_lock_ops() es condicional - solo bloquea cuando netdev_need_ops_lock() devuelve verdadero. Si el dispositivo no requiere ops_lock, linkwatch no mantendr\u00e1 ning\u00fan bloqueo, y netdev_run_todo() al adquirir el bloqueo no proporcionar\u00e1 sincronizaci\u00f3n.\\n\\nSolucione esto moviendo __dev_put() de linkwatch_do_dev() a sus funciones que llaman. La referencia del dispositivo se empareja l\u00f3gicamente con la eliminaci\u00f3n del dispositivo de la lista, por lo que es razonable que la funci\u00f3n que realiz\u00f3 la eliminaci\u00f3n de la lista lo libere. Esto permite colocar __dev_put() despu\u00e9s de que todos los accesos al dispositivo est\u00e9n completos, previniendo UAF.\\n\\nEl error puede reproducirse a\u00f1adiendo mdelay(2000) despu\u00e9s de linkwatch_do_dev() en __linkwatch_run_queue(), luego ejecutando:\\n\\n  ip tuntap add mode tun name tun_test\\n  ip link set tun_test up\\n  ip link set tun_test carrier off\\n  ip link set tun_test carrier on\\n  sleep 0.5\\n  ip tuntap del mode tun name tun_test\\n\\nInforme KASAN:\\n\\n ==================================================================\\n BUG: KASAN: uso despu\u00e9s de liberaci\u00f3n in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]\\n BUG: KASAN: uso despu\u00e9s de liberaci\u00f3n in netdev_unlock_ops include/net/netdev_lock.h:47 [inline]\\n BUG: KASAN: uso despu\u00e9s de liberaci\u00f3n in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245\\n Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123\\n\\n CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full)\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n Workqueue: events_unbound linkwatch_event\\n Call Trace:\\n  \\n  __dump_stack lib/dump_stack.c:94 [inline]\\n  dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\\n  print_address_description mm/kasan/report.c:378 [inline]\\n  print_report+0x156/0x4c9 mm/kasan/report.c:482\\n  kasan_report+0xdf/0x1a0 mm/kasan/report.c:595\\n  netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]\\n  netdev_unlock_ops include/net/netdev_lock.h:47 [inline]\\n  __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245\\n  linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304\\n  process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257\\n  process_scheduled_works kernel/workqueue.c:3340 [inline]\\n  worker_thread+0x5da/0xe40 kernel/workqueue.c:3421\\n  kthread+0x3b3/0x730 kernel/kthread.c:463\\n  ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\\n  \\n ==================================================================\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15.1\",\"versionEndExcluding\":\"6.18.10\",\"matchCriteriaId\":\"DB827D86-B9E2-42C5-80F8-48024FAFEF2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1ECC65A-EE37-4479-8E99-4BB68A22A31F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"90320558-E553-4EF5-8A0B-0F5D20113BD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C300BA32-5854-4B59-A00A-18A402F291D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2718ae6af7445ba2ee0abf6365ca43a9a3b16aeb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83b67cc9be9223183caf91826d9c194d7fb128fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.