Vulnerability-Lookup

RHSA-2026:19569

Vulnerability from csaf_redhat - Published: 2026-05-20 13:03 - Updated: 2026-11-09 22:51

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-56603

A flaw was found in the Linux kernel's CAN (Controller Area Network) subsystem. When an error occurs during socket creation, an internal socket object is released without clearing its associated reference, leaving a dangling pointer. A local user could exploit this use-after-free condition to cause a Denial of Service (DoS) or potentially execute arbitrary code.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 309 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:kernel-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-64k-debug-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-64k-debug-devel-matched-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-64k-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-64k-devel-matched-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-matched-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-matched-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-matched-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debug-devel-matched-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-common-aarch64-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-common-ppc64le-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-common-s390x-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-debuginfo-common-x86_64-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-matched-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-matched-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-matched-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-devel-matched-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-doc-0:6.12.0-211.16.1.el10_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-rt-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-zfcpdump-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-zfcpdump-devel-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:kernel-zfcpdump-devel-matched-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rtla-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rtla-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rtla-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rtla-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rv-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rv-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rv-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:rv-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-0:6.12.0-211.16.1.el10_2.src	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debug-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debug-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debug-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debug-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debug-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-64k-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-abi-stablelists-0:6.12.0-211.16.1.el10_2.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-core-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-core-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-core-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-core-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-core-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-core-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-extra-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-extra-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-modules-extra-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debug-uki-virt-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-common-aarch64-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-common-ppc64le-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-common-s390x-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-debuginfo-common-x86_64-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-core-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-core-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-matched-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-matched-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-matched-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-modules-extra-matched-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-rt-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-libs-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-libs-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-tools-libs-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-uki-virt-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-uki-virt-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-uki-virt-addons-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-uki-virt-addons-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-zfcpdump-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-zfcpdump-core-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-zfcpdump-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-zfcpdump-modules-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-zfcpdump-modules-core-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:kernel-zfcpdump-modules-extra-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-common-aarch64-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-common-ppc64le-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-common-s390x-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-debuginfo-common-x86_64-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-rt-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-libs-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-libs-devel-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-tools-libs-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:kernel-zfcpdump-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-debuginfo-common-x86_64-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-modules-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-modules-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debug-modules-extra-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-modules-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-modules-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-rt-modules-extra-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-debuginfo-common-aarch64-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-debuginfo-common-x86_64-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debug-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-64k-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-modules-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-modules-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debug-modules-extra-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-devel-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-devel-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-modules-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-modules-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-modules-core-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-modules-core-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-modules-extra-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-rt-modules-extra-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:kernel-tools-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:libperf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.2.Z:python3-perf-debuginfo-0:6.12.0-211.16.1.el10_2.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-39766

A flaw was found in the Linux kernel. A local privileged user could cause a Denial of Service (DoS) or system instability by configuring network traffic control with the CAKE (Common Applications Kept Enhanced) queuing discipline under low memory limits. Because the scheduler incorrectly reported dropped packets as successful transmissions, parent schedulers encountered an empty queue condition that triggers a kernel warning. This condition disrupts network traffic scheduling and can crash systems configured to halt on kernel warnings.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-390 - Detection of Error Condition Without Action

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Moderate

CVE-2025-68724

A flaw was found in the Linux kernel's asymmetric keys subsystem. An integer overflow in the asymmetric_key_generate_id function can lead to memory corruption when calculating buffer sizes for asymmetric key identifiers. A local attacker with privileges to load cryptographic certificates into the kernel keyring could exploit this flaw by providing a crafted X.509 certificate with oversized fields. This could result in a Denial of Service (DoS) through a system crash or unauthorized memory disclosure.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Moderate

CVE-2025-68741

A flaw was found in the Linux kernel's qla2xxx driver. An error-handling routine incorrectly releases memory from a pre-allocated pool using standard memory freeing functions instead of the driver's dedicated pool routine. An attacker capable of sending malformed Fibre Channel traffic can trigger this error condition, leading to kernel memory corruption or a Denial of Service (DoS) via a system crash.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Moderate

CVE-2026-23270

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control `act_ct` path when it is incorrectly configured with non-ingress egress qdiscs (queueing disciplines). This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial of service. In some cases, this vulnerability may also be exploited for privilege escalation.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Moderate

CVE-2026-23401

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries (SPTEs) during memory-mapped I/O (MMIO) operations. By manipulating guest page table entries (gPTEs) from host userspace, an attacker could cause KVM to install an MMIO SPTE without properly removing an existing shadow-present SPTE. This improper handling could lead to a kernel warning, resulting in a denial of service or potentially allowing for privilege escalation or information disclosure.

8.1 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Important

CVE-2026-31402

A flaw was found in the Linux kernel's NFSv4.0 server (nfsd). A remote, unauthenticated attacker can exploit this heap overflow vulnerability in the NFSv4.0 LOCK replay cache. By using two cooperating NFSv4.0 clients, where one sets a lock with a large owner string and another requests a conflicting lock, the attacker can trigger a slab-out-of-bounds write. This corruption of adjacent heap memory could lead to arbitrary code execution or a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Important

CVE-2026-31408

A flaw was found in the Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) protocol implementation. The `sco_recv_frame()` function fails to properly hold a reference to a socket after releasing a lock. This oversight allows a concurrent operation to free the socket while it is still being accessed, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause memory corruption or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Moderate

CVE-2026-31607

A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Important

CVE-2026-43128

A flaw was found in the Linux kernel's RDMA/umem subsystem. A memory management error, specifically a double unpin of a `dma_buf`, can occur in a failure path during `dma_buf` pinning operations. This vulnerability could lead to system instability or a crash, resulting in a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Moderate

CVE-2026-43284

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-123 - Write-what-where Condition

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Important

CVE-2026-43503

A flaw was found in the Linux kernel's networking (skbuff) component. When skb_try_coalesce() attaches paged fragments, it can lose the SKBFL_SHARED_FRAG marker. This can lead to the Encapsulating Security Payload (ESP) input decrypting data in place over page-cache backed fragments, potentially resulting in data corruption.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-664 - Improper Control of a Resource Through its Lifetime

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Important

CVE-2026-46300

A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem. Unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. An attacker can exploit this to overwrite privileged binaries and gain root privileges.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-123 - Write-what-where Condition

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Exploit Status CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Impact Important

CVE-2026-46333

A vulnerability was found in the Linux kernel that allows an unprivileged local user to read sensitive files normally restricted to the root user. The flaw occurs during process exit, where a brief window allows an attacker to intercept file access from a privileged process before it fully terminates. Successful exploitation may lead to the disclosure of sensitive data such as SSH host private keys or /etc/shadow contents.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-269 - Improper Privilege Management

Affected products

Fixed 309 products, the same list as for CVE-2024-56603

Threats

Impact Important

References

90 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:19569	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2334439	external
https://bugzilla.redhat.com/show_bug.cgi?id=2394648	external
https://bugzilla.redhat.com/show_bug.cgi?id=2424886	external
https://bugzilla.redhat.com/show_bug.cgi?id=2425046	external
https://bugzilla.redhat.com/show_bug.cgi?id=2448745	external
https://bugzilla.redhat.com/show_bug.cgi?id=2453803	external
https://bugzilla.redhat.com/show_bug.cgi?id=2454844	external
https://bugzilla.redhat.com/show_bug.cgi?id=2455334	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461521	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467144	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467771	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477015	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477802	external
https://issues.redhat.com/browse/RHEL-169354	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-56603	self
https://bugzilla.redhat.com/show_bug.cgi?id=2334439	external
https://www.cve.org/CVERecord?id=CVE-2024-56603	external
https://nvd.nist.gov/vuln/detail/CVE-2024-56603	external
https://lore.kernel.org/linux-cve-announce/202412…	external
https://access.redhat.com/security/cve/CVE-2025-39766	self
https://bugzilla.redhat.com/show_bug.cgi?id=2394648	external
https://www.cve.org/CVERecord?id=CVE-2025-39766	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39766	external
https://lore.kernel.org/linux-cve-announce/202509…	external
https://access.redhat.com/security/cve/CVE-2025-68724	self
https://bugzilla.redhat.com/show_bug.cgi?id=2424886	external
https://www.cve.org/CVERecord?id=CVE-2025-68724	external
https://nvd.nist.gov/vuln/detail/CVE-2025-68724	external
https://lore.kernel.org/linux-cve-announce/202512…	external
https://access.redhat.com/security/cve/CVE-2025-68741	self
https://bugzilla.redhat.com/show_bug.cgi?id=2425046	external
https://www.cve.org/CVERecord?id=CVE-2025-68741	external
https://nvd.nist.gov/vuln/detail/CVE-2025-68741	external
https://lore.kernel.org/linux-cve-announce/202512…	external
https://access.redhat.com/security/cve/CVE-2026-23270	self
https://bugzilla.redhat.com/show_bug.cgi?id=2448745	external
https://www.cve.org/CVERecord?id=CVE-2026-23270	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23270	external
https://lore.kernel.org/linux-cve-announce/202603…	external
https://access.redhat.com/security/cve/CVE-2026-23401	self
https://bugzilla.redhat.com/show_bug.cgi?id=2453803	external
https://www.cve.org/CVERecord?id=CVE-2026-23401	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23401	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31402	self
https://bugzilla.redhat.com/show_bug.cgi?id=2454844	external
https://www.cve.org/CVERecord?id=CVE-2026-31402	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31402	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31408	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455334	external
https://www.cve.org/CVERecord?id=CVE-2026-31408	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31408	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31607	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461521	external
https://www.cve.org/CVERecord?id=CVE-2026-31607	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31607	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-43128	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467144	external
https://www.cve.org/CVERecord?id=CVE-2026-43128	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43128	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43284	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467771	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-43284	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43284	external
https://dirtyfrag.io/	external
https://access.redhat.com/security/cve/CVE-2026-43503	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480902	external
https://www.cve.org/CVERecord?id=CVE-2026-43503	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43503	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-46300	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477015	external
https://www.cve.org/CVERecord?id=CVE-2026-46300	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46300	external
https://www.cisa.gov/known-exploited-vulnerabilit…	external
https://access.redhat.com/security/cve/CVE-2026-46333	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477802	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-46333	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46333	external
https://blog.qualys.com/vulnerabilities-threat-re…	external
https://github.com/torvalds/linux/commit/31e62c2e…	external

JSON

To clipboard

Loading 1.5 MB of JSON…

BDU:2026-12288 (CVE-2026-23270)

Vulnerability from fstec – Published: 2026-08-25 – Updated: 2026-10-26 – View on bdu.fstec.ru Fixed

Title

Уязвимость функций tcf_ct_init() модуля net/sched/act_ct.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции tcf_ct_init() модуля net/sched/act_ct.c ядра операционной системы Linux связана с повторным использованием ранее освобожденной памяти. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-416 - Использование после освобождения

Aliases

CVE-2026-23270, DSA-6238-1, DSA-6243-1, RHSA-2026:13565, RHSA-2026:13566, RHSA-2026:19568, RHSA-2026:19569, RHSA-2026:21209, RHSA-2026:21706, RHSA-2026:21745, RHSA-2026:22900, RHSA-2026:22940, RHSA-2026:23224, RHSA-2026:24343, RHSA-2026:35863, 4561-1

References

10 references

URL
https://www.cve.org/CVERecord?id=CVE-2026-23270
https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e
https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6
https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4
https://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189
https://security-tracker.debian.org/tracker/CVE-2026-23270
https://access.redhat.com/security/cve/CVE-2026-23270
https://altsp.su/obnovleniya-bezopasnosti/
https://redos.red-soft.ru/support/secure/
https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-1002SE17HF

Impacted products

7 products from 7 vendors

Vendors

Red Hat, Inc., Canonical Ltd., Сообщество свободного программного обеспечения, ООО «Ред Софт», ООО «РусБИТех-Астра», АО «ИВК»

Products

Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), Astra Linux Special Edition (запись в едином реестре российских программ №369), АЛЬТ СП 10, Linux

Versions

8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (РЕД ОС), 1.7 (Astra Linux Special Edition), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), - (АЛЬТ СП 10), 9.2 Extended Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 9.4 Extended Update Support (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (РЕД ОС), 10.0 Extended Update Support (Red Hat Enterprise Linux), от 5.15.148 до 5.16 (Linux), от 6.1.75 до 6.2 (Linux), от 6.6.14 до 6.7 (Linux), от 6.7.2 до 6.12.76 включительно (Linux), от 6.13 до 6.18.17 включительно (Linux), от 6.19 до 6.19.7 включительно (Linux)

Product types

Operating system

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 8, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), ООО «РусБИТех-Астра» Astra Linux Special Edition 1.7 (запись в едином реестре российских программ №369), Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, АО «ИВК» АЛЬТ СП 10 -, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support, Inc. Red Hat Enterprise Linux 10, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Сообщество свободного программного обеспечения Debian GNU/Linux 13, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Inc. Red Hat Enterprise Linux 10.0 Extended Update Support, Сообщество свободного программного обеспечения Linux от 5.15.148 до 5.16, Сообщество свободного программного обеспечения Linux от 6.1.75 до 6.2, Сообщество свободного программного обеспечения Linux от 6.6.14 до 6.7, Сообщество свободного программного обеспечения Linux от 6.7.2 до 6.12.76 включительно, Сообщество свободного программного обеспечения Linux от 6.13 до 6.18.17 включительно, Сообщество свободного программного обеспечения Linux от 6.19 до 6.19.7 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4 https://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-23270 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/CVE-2026-23270 Для Ubuntu: https://access.redhat.com/security/cve/CVE-2026-23270 Для ОС АЛЬТ СП 10: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/ Для Ред ОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/ Для Ред ОС: http://repo.red-soft.ru/redos/8.0/aarch64/updates/ Для ОС Astra Linux: - обновить пакет linux-6.1 до 6.1.170-1.astra1+ci5r25 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-1002SE17HF - обновить пакет linux-5.15 до 5.15.0-191.astra1+ci235 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-1002SE17HF

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 1.7 (Astra Linux Special Edition), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), 9.2 Extended Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 9.4 Extended Update Support (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 10.0 Extended Update Support (Red Hat Enterprise Linux), \u043e\u0442 5.15.148 \u0434\u043e 5.16 (Linux), \u043e\u0442 6.1.75 \u0434\u043e 6.2 (Linux), \u043e\u0442 6.6.14 \u0434\u043e 6.7 (Linux), \u043e\u0442 6.7.2 \u0434\u043e 6.12.76 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 6.13 \u0434\u043e 6.18.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 6.19 \u0434\u043e 6.19.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\n\u0414\u043b\u044f Linux:\n\nhttps://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e\nhttps://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6\nhttps://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4\nhttps://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189\n\n\n\n\u0414\u043b\u044f Debian GNU/Linux:\n\nhttps://security-tracker.debian.org/tracker/CVE-2026-23270\n\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\n\nhttps://access.redhat.com/security/cve/CVE-2026-23270\n\n\n\u0414\u043b\u044f Ubuntu:\n\nhttps://access.redhat.com/security/cve/CVE-2026-23270\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u041b\u042c\u0422 \u0421\u041f 10: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430: https://altsp.su/obnovleniya-bezopasnosti/\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/8.0/x86_64/updates/\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/8.0/aarch64/updates/\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 linux-6.1 \u0434\u043e 6.1.170-1.astra1+ci5r25 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-1002SE17HF\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 linux-5.15 \u0434\u043e 5.15.0-191.astra1+ci235 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-1002SE17HF",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "27.02.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "25.08.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-12288",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-23270, DSA-6238-1, DSA-6243-1, RHSA-2026:13565, RHSA-2026:13566, RHSA-2026:19568, RHSA-2026:19569, RHSA-2026:21209, RHSA-2026:21706, RHSA-2026:21745, RHSA-2026:22900, RHSA-2026:22940, RHSA-2026:23224, RHSA-2026:24343, RHSA-2026:35863, 4561-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0410\u041b\u042c\u0422 \u0421\u041f 10, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 8 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.7  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support , Red Hat, Inc. Red Hat Enterprise Linux 10 , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Red Hat, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.15.148 \u0434\u043e 5.16 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.1.75 \u0434\u043e 6.2 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.6.14 \u0434\u043e 6.7 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7.2 \u0434\u043e 6.12.76 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.13 \u0434\u043e 6.18.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19 \u0434\u043e 6.19.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 tcf_ct_init() \u043c\u043e\u0434\u0443\u043b\u044f net/sched/act_ct.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 tcf_ct_init() \u043c\u043e\u0434\u0443\u043b\u044f net/sched/act_ct.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u044b\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u043d\u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cve.org/CVERecord?id=CVE-2026-23270\n\nhttps://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e\nhttps://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6\nhttps://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4\nhttps://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189\n\nhttps://security-tracker.debian.org/tracker/CVE-2026-23270\n\nhttps://access.redhat.com/security/cve/CVE-2026-23270\nhttps://altsp.su/obnovleniya-bezopasnosti/\nhttps://redos.red-soft.ru/support/secure/\nhttps://redos.red-soft.ru/support/secure/\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-1002SE17HF",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2024-56603 (GCVE-0-2024-56603)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-08-05 11:45

Title

net: af_can: do not leave a dangling sk pointer in can_create()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-11 15:42 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/884ae8bcee749be43…
https://git.kernel.org/stable/c/ce39b5576785bb3e6…
https://git.kernel.org/stable/c/1fe625f12d090d69f…
https://git.kernel.org/stable/c/5947c9ac08f0771ea…
https://git.kernel.org/stable/c/db207d19adbac9605…
https://git.kernel.org/stable/c/8df832e6b945e1ba6…
https://git.kernel.org/stable/c/811a7ca7320c062e1…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < 884ae8bcee749be43a071d6ed2d89058dbd2425c (git) Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < ce39b5576785bb3e66591145aad03d66bc3e778d (git) Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < 1fe625f12d090d69f3f084990c7e4c1ff94bfe5f (git) Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < 5947c9ac08f0771ea8ed64186b0d52e9029cb6c0 (git) Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < db207d19adbac96058685f6257720906ad41d215 (git) Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < 8df832e6b945e1ba61467d7f1c9305e314ae92fe (git) Affected: 0d66548a10cbbe0ef256852d63d30603f0f73f9b , < 811a7ca7320c062e15d0f5b171fe6ad8592d1434 (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.4.287 , ≤ 5.4.* (semver) Unaffected: 5.10.231 , ≤ 5.10.* (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56603",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:42:16.822268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:23.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:46.640Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/af_can.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "884ae8bcee749be43a071d6ed2d89058dbd2425c",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            },
            {
              "lessThan": "ce39b5576785bb3e66591145aad03d66bc3e778d",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            },
            {
              "lessThan": "1fe625f12d090d69f3f084990c7e4c1ff94bfe5f",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            },
            {
              "lessThan": "5947c9ac08f0771ea8ed64186b0d52e9029cb6c0",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            },
            {
              "lessThan": "db207d19adbac96058685f6257720906ad41d215",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            },
            {
              "lessThan": "8df832e6b945e1ba61467d7f1c9305e314ae92fe",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            },
            {
              "lessThan": "811a7ca7320c062e15d0f5b171fe6ad8592d1434",
              "status": "affected",
              "version": "0d66548a10cbbe0ef256852d63d30603f0f73f9b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/af_can.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_can: do not leave a dangling sk pointer in can_create()\n\nOn error can_create() frees the allocated sk object, but sock_init_data()\nhas already attached it to the provided sock object. This will leave a\ndangling sk pointer in the sock object and may cause use-after-free later."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect lives in the `socket(AF_CAN, SOCK_RAW, CAN_RAW)` creation path, reached only through a local syscall via `__sock_create()`; no CAN-bus frame or network data reaches `can_create()`. Consistent with the Bluetooth and af_packet siblings in the same series, which were also scored AV:L because the flaw is in socket setup rather than frame processing.\nAC:L - The only failing `-\u003einit` is `raw_init()`\u0027s `alloc_percpu(struct uniqframe)` returning `-ENOMEM`, and an unprivileged local attacker can drive the percpu allocator into failure by spraying percpu-consuming objects (including CAN raw sockets themselves) before retrying `socket()` in a tight loop. This is the same attacker-induced-ENOMEM shape as the af_packet sibling CVE-2024-56606, which was scored AC:L.\nPR:L - `can_create()` performs no `capable()` check at all \u2014 unlike af_packet there is no `CAP_NET_RAW` gate \u2014 and there is no `net_eq(net, \u0026init_net)` restriction, so any unprivileged local user, including inside an unprivileged user namespace, can reach it. Where `CONFIG_CAN` is modular, `MODULE_ALIAS_NETPROTO(PF_CAN)` lets the unprivileged `socket()` call autoload the module itself.\nUI:N - The attacker performs the entire sequence \u2014 memory pressure plus repeated `socket()` calls \u2014 from its own process. No victim action, mount, or file open is involved.\nS:U - The freed `struct raw_sock`/`struct sock` and the stale `sock-\u003esk` reference both live entirely within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Per the use-after-free rubric, the stale `sock-\u003esk` pointing at a freed `raw_sock` in the general kmalloc caches lets an attacker reclaim the slab and read back attacker-shaped or leftover kernel data; the demonstrated consumer for this exact bug class (CVE-2024-40954) is a KASAN-confirmed slab-use-after-free *read* of the freed sock via `__sock_gen_cookie()`.\nI:H - The same dangling reference permits heap spraying of the reclaimed slot, giving control over function-pointer-bearing fields of `struct sock` (`sk_prot`, `sk_destruct`, `sk_wq`) and therefore a control-flow-hijack primitive rather than mere data corruption.\nA:H - Any dereference of the freed `sock-\u003esk` before `iput()` faults or corrupts kernel state, producing an oops or panic; the rubric treats all use-after-free conditions as high availability impact even when only partially exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:23.876Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/884ae8bcee749be43a071d6ed2d89058dbd2425c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce39b5576785bb3e66591145aad03d66bc3e778d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fe625f12d090d69f3f084990c7e4c1ff94bfe5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5947c9ac08f0771ea8ed64186b0d52e9029cb6c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/db207d19adbac96058685f6257720906ad41d215"
        },
        {
          "url": "https://git.kernel.org/stable/c/8df832e6b945e1ba61467d7f1c9305e314ae92fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/811a7ca7320c062e15d0f5b171fe6ad8592d1434"
        }
      ],
      "title": "net: af_can: do not leave a dangling sk pointer in can_create()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56603",
    "datePublished": "2024-12-27T14:51:08.923Z",
    "dateReserved": "2024-12-27T14:03:06.012Z",
    "dateUpdated": "2026-08-05T11:45:23.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39766 (GCVE-0-2025-39766)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-06-11 18:44

Title

net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/7689ab22de36f8db1…
https://git.kernel.org/stable/c/de04ddd2980b48caa…
https://git.kernel.org/stable/c/0dacfc5372e314d12…
https://git.kernel.org/stable/c/710866fc0a64eafcb…
https://git.kernel.org/stable/c/aa12ee1c1bd260943…
https://git.kernel.org/stable/c/ff57186b2cc397666…
https://git.kernel.org/stable/c/62d591dde4defb133…
https://git.kernel.org/stable/c/15de71d06a400f7fd…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 7689ab22de36f8db19095f6bdf11f28cfde92f5c (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < de04ddd2980b48caa8d7e24a7db2742917a8b280 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 0dacfc5372e314d1219f03e64dde3ab495a5a25e (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 710866fc0a64eafcb8bacd91bcb1329eb7e5035f (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < aa12ee1c1bd260943fd6ab556d8635811c332eeb (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < ff57186b2cc39766672c4c0332323933e5faaa88 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 62d591dde4defb1333d202410609c4ddeae060b3 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 15de71d06a400f7fdc15bf377a2552b0ec437cf5 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.149 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:11.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:51.305Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:58.138217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:07.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7689ab22de36f8db19095f6bdf11f28cfde92f5c",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "de04ddd2980b48caa8d7e24a7db2742917a8b280",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "0dacfc5372e314d1219f03e64dde3ab495a5a25e",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "710866fc0a64eafcb8bacd91bcb1329eb7e5035f",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "aa12ee1c1bd260943fd6ab556d8635811c332eeb",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "ff57186b2cc39766672c4c0332323933e5faaa88",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "62d591dde4defb1333d202410609c4ddeae060b3",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "15de71d06a400f7fdc15bf377a2552b0ec437cf5",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit\n\nThe following setup can trigger a WARNING in htb_activate due to\nthe condition: !cl-\u003eleaf.q-\u003eq.qlen\n\ntc qdisc del dev lo root\ntc qdisc add dev lo root handle 1: htb default 1\ntc class add dev lo parent 1: classid 1:1 \\\n       htb rate 64bit\ntc qdisc add dev lo parent 1:1 handle f: \\\n       cake memlimit 1b\nping -I lo -f -c1 -s64 -W0.001 127.0.0.1\n\nThis is because the low memlimit leads to a low buffer_limit, which\ncauses packet dropping. However, cake_enqueue still returns\nNET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an\nempty child qdisc. We should return NET_XMIT_CN when packets are\ndropped from the same tin and flow.\n\nI do not believe return value of NET_XMIT_CN is necessary for packet\ndrops in the case of ack filtering, as that is meant to optimize\nperformance, not to signal congestion."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:50.638Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7689ab22de36f8db19095f6bdf11f28cfde92f5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/de04ddd2980b48caa8d7e24a7db2742917a8b280"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dacfc5372e314d1219f03e64dde3ab495a5a25e"
        },
        {
          "url": "https://git.kernel.org/stable/c/710866fc0a64eafcb8bacd91bcb1329eb7e5035f"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa12ee1c1bd260943fd6ab556d8635811c332eeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff57186b2cc39766672c4c0332323933e5faaa88"
        },
        {
          "url": "https://git.kernel.org/stable/c/62d591dde4defb1333d202410609c4ddeae060b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/15de71d06a400f7fdc15bf377a2552b0ec437cf5"
        }
      ],
      "title": "net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39766",
    "datePublished": "2025-09-11T16:56:21.514Z",
    "dateReserved": "2025-04-16T07:20:57.126Z",
    "dateUpdated": "2026-06-11T18:44:07.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68724 (GCVE-0-2025-68724)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:33 – Updated: 2026-11-10 12:38

Title

crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 19:22 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/60a7be5ee74408147…
https://git.kernel.org/stable/c/c13c6e9de91d7f1dd…
https://git.kernel.org/stable/c/dfc16139618287451…
https://git.kernel.org/stable/c/5b8ac617c8dab5cad…
https://git.kernel.org/stable/c/c73be4f51eed98fa0…
https://git.kernel.org/stable/c/6af753ac5205115e6…
https://git.kernel.org/stable/c/b7090a5c153105b9f…
https://git.kernel.org/stable/c/df0845cf447ae1556…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

12 products

Vendor	Product	Version
Linux	Linux	Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < 60a7be5ee74408147e439164ac067e418ca74bb4 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < c13c6e9de91d7f1dd7df756b1fa5a1f968839d76 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < dfc1613961828745165aec6552c3818fa14ab725 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < 5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < c73be4f51eed98fa0c7c189db8f279e1c86bfbf7 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < 6af753ac5205115e6c310c8c4236c01b59a1c44f (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < b7090a5c153105b9fd221a5a81459ee8cd5babd6 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < df0845cf447ae1556c3440b8b155de0926cbaa56 (git)
Linux	Linux	Affected: 3.18 Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.63 , ≤ 6.12.* (semver) Unaffected: 6.17.13 , ≤ 6.17.* (semver) Unaffected: 6.18.2 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.7 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:22:49.497362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:22:59.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T12:38:16.189Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/asymmetric_keys/asymmetric_type.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60a7be5ee74408147e439164ac067e418ca74bb4",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "c13c6e9de91d7f1dd7df756b1fa5a1f968839d76",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "dfc1613961828745165aec6552c3818fa14ab725",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "c73be4f51eed98fa0c7c189db8f279e1c86bfbf7",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "6af753ac5205115e6c310c8c4236c01b59a1c44f",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "b7090a5c153105b9fd221a5a81459ee8cd5babd6",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "df0845cf447ae1556c3440b8b155de0926cbaa56",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/asymmetric_keys/asymmetric_type.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id\n\nUse check_add_overflow() to guard against potential integer overflows\nwhen adding the binary blob lengths and the size of an asymmetric_key_id\nstructure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a\npossible buffer overflow when copying data from potentially malicious\nX.509 certificate fields that can be arbitrarily large, such as ASN.1\nINTEGER serial numbers, issuer names, etc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable X.509 parsing path is reached through the local add_key syscall and related local PKCS#7 consumers, not directly through network packet processing.\nAC:L - The overflow is deterministic from attacker-controlled certificate field lengths and requires no race, victim-controlled state, or unpredictable condition.\nPR:L - An ordinary unprivileged user can submit an asymmetric key to a writable process or session keyring without capabilities. Parsing occurs before certificate trust and keyring restriction checks.\nUI:N - The attacker directly invokes the keyring interface with the crafted certificate, requiring no action by another user.\nS:U - Exploitation compromises the kernel within the same host security authority and does not inherently cross a VM, IOMMU, or other distinct security boundary.\nC:H - The undersized allocation followed by oversized memcpy operations can corrupt kernel heap objects and potentially enable kernel code execution with arbitrary memory disclosure.\nI:H - The heap out-of-bounds writes can overwrite adjacent objects, function pointers, or credentials, potentially enabling arbitrary kernel writes and control-flow hijacking.\nA:H - The overflow can immediately produce an oops or kernel panic and can be triggered repeatedly by an unprivileged local attacker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:08.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60a7be5ee74408147e439164ac067e418ca74bb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c13c6e9de91d7f1dd7df756b1fa5a1f968839d76"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfc1613961828745165aec6552c3818fa14ab725"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c73be4f51eed98fa0c7c189db8f279e1c86bfbf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6af753ac5205115e6c310c8c4236c01b59a1c44f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7090a5c153105b9fd221a5a81459ee8cd5babd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/df0845cf447ae1556c3440b8b155de0926cbaa56"
        }
      ],
      "title": "crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68724",
    "datePublished": "2025-12-24T10:33:08.932Z",
    "dateReserved": "2025-12-24T10:30:51.027Z",
    "dateUpdated": "2026-11-10T12:38:16.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68741 (GCVE-0-2025-68741)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:09 – Updated: 2026-08-05 12:11

Title

scsi: qla2xxx: Fix improper freeing of purex item

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc(). An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption. Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 19:31 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/4bccd506a1f1ab01d…
https://git.kernel.org/stable/c/8e9f0a0717ba31d58…
https://git.kernel.org/stable/c/cfe3e2f768d248fd3…
https://git.kernel.org/stable/c/5fa1c8226b4532ad7…
https://git.kernel.org/stable/c/78b1a242fe612a755…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < 4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9 (git) Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < 8e9f0a0717ba31d5842721627ade1e62d7aec012 (git) Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < cfe3e2f768d248fd3d965d561d0768a56dd0b9f8 (git) Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < 5fa1c8226b4532ad7011d295d3ab4ad45df105ae (git) Affected: 875386b98857822b77ac7f95bdf367b70af5b78c , < 78b1a242fe612a755f2158fd206ee6bb577d18ca (git)
Linux	Linux	Affected: 6.6 Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.63 , ≤ 6.12.* (semver) Unaffected: 6.17.13 , ≤ 6.17.* (semver) Unaffected: 6.18.2 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68741",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:31:58.802980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:32:08.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_nvme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "8e9f0a0717ba31d5842721627ade1e62d7aec012",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "cfe3e2f768d248fd3d965d561d0768a56dd0b9f8",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "5fa1c8226b4532ad7011d295d3ab4ad45df105ae",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "78b1a242fe612a755f2158fd206ee6bb577d18ca",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_nvme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix improper freeing of purex item\n\nIn qla2xxx_process_purls_iocb(), an item is allocated via\nqla27xx_copy_multiple_pkt(), which internally calls\nqla24xx_alloc_purex_item().\n\nThe qla24xx_alloc_purex_item() function may return a pre-allocated item\nfrom a per-adapter pool for small allocations, instead of dynamically\nallocating memory with kzalloc().\n\nAn error handling path in qla2xxx_process_purls_iocb() incorrectly uses\nkfree() to release the item. If the item was from the pre-allocated\npool, calling kfree() on it is a bug that can lead to memory corruption.\n\nFix this by using the correct deallocation function,\nqla24xx_free_purex_item(), which properly handles both dynamically\nallocated and pre-allocated items."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An attacker-controlled or compromised FC-NVMe target can send unsolicited Link Service frames that HBA firmware delivers as PT_LS4_UNSOL to the vulnerable function. This remote storage-network traffic can traverse switched or extended FC fabrics without local victim access.\nAC:L - The peer controls a sub-64-byte LS request so qla24xx_alloc_purex_item() selects the embedded default item, and repeated request flooding can pressure GFP_ATOMIC allocations until the subsequent context allocation fails. No attacker-uncontrollable race or address guess is required.\nPR:N - The source ID must match a discovered, non-deleted FC port, but the vulnerable path performs no credential, capability, or authorization check. An attacker operating that remote peer requires no privileges on the victim.\nUI:N - Processing occurs automatically in the HBA interrupt response path when the unsolicited FC-NVMe frame arrives. No victim action is required during exploitation.\nS:U - The corruption compromises the kernel and resources governed by that same host security authority. It does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - Freeing the embedded item can poison allocator metadata or release memory backing the live Scsi_Host and qla adapter state, creating a powerful use-after-free and reclaim opportunity. Heap shaping can leverage this corruption to disclose arbitrary kernel memory.\nI:H - The invalid free permits reuse and corruption of live kernel and adapter structures. Attacker-influenced allocations and payload processing can turn this into arbitrary writes or control-flow hijacking.\nA:H - The invalid free can immediately trigger allocator diagnostics, an oops, or a panic, while undetected slab corruption and use-after-free can crash the kernel later. The remote peer can repeat the triggering traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:13.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e9f0a0717ba31d5842721627ade1e62d7aec012"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfe3e2f768d248fd3d965d561d0768a56dd0b9f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fa1c8226b4532ad7011d295d3ab4ad45df105ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/78b1a242fe612a755f2158fd206ee6bb577d18ca"
        }
      ],
      "title": "scsi: qla2xxx: Fix improper freeing of purex item",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68741",
    "datePublished": "2025-12-24T12:09:38.655Z",
    "dateReserved": "2025-12-24T10:30:51.030Z",
    "dateUpdated": "2026-08-05T12:11:13.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23270 (GCVE-0-2026-23270)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:54 – Updated: 2026-11-10 12:42

Title

net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:07 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/bc4e5bb529823a09f…
https://git.kernel.org/stable/c/fb3c380a54e33d1fd…
https://git.kernel.org/stable/c/5a110ddcc99bda77a…
https://git.kernel.org/stable/c/524ce8b4ea8f64900…
https://git.kernel.org/stable/c/380ad8b7c65ea7aa1…
https://git.kernel.org/stable/c/9deda0fcda5c1f388…
https://git.kernel.org/stable/c/11cb63b0d1a0685e0…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

18 products

Vendor	Product	Version
Linux	Linux	Affected: 172ba7d46c202e679f3ccb10264c67416aaeb1c4 , < bc4e5bb529823a09f02dbe96169de679a9db26e0 (git) Affected: 0b5b831122fc3789fff75be433ba3e4dd7b779d4 , < fb3c380a54e33d1fd272cc342faa906d787d7ef1 (git) Affected: 73f7da5fd124f2cda9161e2e46114915e6e82e97 , < 5a110ddcc99bda77a28598b3555fe009eaab3828 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 524ce8b4ea8f64900b6c52b6a28df74f6bc0801e (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 9deda0fcda5c1f388c5e279541850b71a2ccfcf4 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 11cb63b0d1a0685e0831ae3c77223e002ef18189 (git) Affected: f5346df0591d10bc948761ca854b1fae6d2ef441 (git) Affected: 5.15.148 , < 5.15.203 (semver) Affected: 6.1.75 , < 6.1.167 (semver) Affected: 6.6.14 , < 6.6.130 (semver) Affected: 6.7.2 , < 6.8 (semver)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.7 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T12:42:07.696Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23270",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:07:05.717761Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:40.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc4e5bb529823a09f02dbe96169de679a9db26e0",
              "status": "affected",
              "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
              "versionType": "git"
            },
            {
              "lessThan": "fb3c380a54e33d1fd272cc342faa906d787d7ef1",
              "status": "affected",
              "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
              "versionType": "git"
            },
            {
              "lessThan": "5a110ddcc99bda77a28598b3555fe009eaab3828",
              "status": "affected",
              "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
              "versionType": "git"
            },
            {
              "lessThan": "524ce8b4ea8f64900b6c52b6a28df74f6bc0801e",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "9deda0fcda5c1f388c5e279541850b71a2ccfcf4",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "11cb63b0d1a0685e0831ae3c77223e002ef18189",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.130",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\nAs Paolo said earlier [1]:\n\n\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\nthe current skb being held by the defragmentation engine. As reported by\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\nlater on tries to tuch again such packet.\"\n\nact_ct was never meant to be used in the egress path, however some users\nare attaching it to egress today [2]. Attempting to reach a middle\nground, we noticed that, while most qdiscs are not handling\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\naddress the issue by only allowing act_ct to bind to clsact/ingress\nqdiscs and shared blocks. That way it\u0027s still possible to attach act_ct to\negress (albeit only with clsact).\n\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploiting this requires local access to configure tc qdiscs/filters via netlink (RTM_NEWTFILTER), which is a local operation requiring CAP_NET_ADMIN. The UaF is then triggered by sending packets through the misconfigured egress path.\nAC:L - The attacker fully controls the setup: creating the namespace, configuring the qdisc with act_ct, and sending fragmented packets to trigger defragmentation. The UaF is reliably triggered without needing to win any external race.\nPR:L - CAP_NET_ADMIN is required for tc filter creation, but this capability is obtainable by any unprivileged local user via user namespaces (unshare -Urn), making this reachable with low privileges.\nUI:N - No user interaction is needed. The attacker sets up the tc configuration and sends packets entirely on their own.\nS:U - This is a standard kernel memory corruption vulnerability. The impact stays within the kernel\u0027s security authority with no cross-boundary escape (no VM escape or sandbox escape).\nC:H - The use-after-free allows an attacker to control freed object contents via heap spraying, enabling arbitrary kernel memory reads and information disclosure.\nI:H - The use-after-free provides arbitrary write primitives through heap spraying of the freed skb, enabling code execution and full kernel compromise.\nA:H - The use-after-free causes kernel crashes (oops/panic) when the qdisc accesses the freed skb, as demonstrated in the original crash trace in the blamed commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:00.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828"
        },
        {
          "url": "https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e"
        },
        {
          "url": "https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189"
        }
      ],
      "title": "net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23270",
    "datePublished": "2026-03-18T17:54:43.803Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-11-10T12:42:07.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23401 (GCVE-0-2026-23401)

Vulnerability from cvelistv5 – Published: 2026-04-01 08:36 – Updated: 2026-11-05 21:33

Title

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]---

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 21:30 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

28 references

URL	Tags
https://git.kernel.org/stable/c/20656cd1f243d3a15…
https://git.kernel.org/stable/c/ed5909992f344a7d3…
https://git.kernel.org/stable/c/fd28c5618699180cd…
https://git.kernel.org/stable/c/459158151a158a670…
https://git.kernel.org/stable/c/695320de6eadb75aa…
https://git.kernel.org/stable/c/bce7fe59d43531623…
https://git.kernel.org/stable/c/aad885e774966e97b…
https://access.redhat.com/security/cve/CVE-2026-23401	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2453803	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:15883	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19569	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13936	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20593	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13932	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14339	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13577	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14230	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36532	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36533	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13578	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14137	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19875	vendor-advisoryx_refsource_REDHAT

Impacted products

26 products

Vendor	Product	Version
Linux	Linux	Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < 20656cd1f243d3a154aac5dd1b823110b6906fe1 (git) Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < ed5909992f344a7d3f4024261e9f751d9618a27d (git) Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < fd28c5618699180cd69619801e9ae6a5266c0a22 (git) Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < 459158151a158a6703b49f3c9de0e536d8bd553f (git) Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < 695320de6eadb75aaed8be1787c4ce4c189e4c7b (git) Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < bce7fe59d43531623f3e43779127bfb33804925d (git) Affected: a54aa15c6bda3ca7e2f9e040ba968a1da303e24f , < aad885e774966e97b675dfe928da164214a71605 (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.16.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.72.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.123.1.rt7.464.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.123.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.191.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:4.18.0-372.191.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:4.18.0-372.191.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.143.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.143.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.10.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:5.14.0-70.178.1.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:5.14.0-70.178.1.rt21.250.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.172.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.172.1.rt14.457.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:5.14.0-427.124.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.112.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.16.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.72.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.123.1.rt7.464.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.123.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.191.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.191.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.191.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.143.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.143.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.10.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-70.178.1.el9_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-70.178.1.rt21.250.el9_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.172.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.172.1.rt14.457.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.124.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.112.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-01T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries (SPTEs) during memory-mapped I/O (MMIO) operations. By manipulating guest page table entries (gPTEs) from host userspace, an attacker could cause KVM to install an MMIO SPTE without properly removing an existing shadow-present SPTE. This improper handling could lead to a kernel warning, resulting in a denial of service or potentially allowing for privilege escalation or information disclosure."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:18:42.620Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-23401"
          },
          {
            "name": "RHBZ#2453803",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453803"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23401.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15883"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19569"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13936"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:20593"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13932"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14339"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19568"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13577"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36530"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14230"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36532"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36533"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36534"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13578"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14137"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19875"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:15883: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13936: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:20593: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13932: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14339: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13577: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36530: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14230: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19521: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36531: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36532: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36533: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36534: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13578: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14137: Red Hat Enterprise Linux NFV E4S (v.9.0), Red Hat Enterprise Linux Real Time E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19875: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-01T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-01T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T21:30:14.022516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T21:33:45.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20656cd1f243d3a154aac5dd1b823110b6906fe1",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "ed5909992f344a7d3f4024261e9f751d9618a27d",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "fd28c5618699180cd69619801e9ae6a5266c0a22",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "459158151a158a6703b49f3c9de0e536d8bd553f",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "695320de6eadb75aaed8be1787c4ce4c189e4c7b",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "bce7fe59d43531623f3e43779127bfb33804925d",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            },
            {
              "lessThan": "aad885e774966e97b675dfe928da164214a71605",
              "status": "affected",
              "version": "a54aa15c6bda3ca7e2f9e040ba968a1da303e24f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE\n\nWhen installing an emulated MMIO SPTE, do so *after* dropping/zapping the\nexisting SPTE (if it\u0027s shadow-present).  While commit a54aa15c6bda3 was\nright about it being impossible to convert a shadow-present SPTE to an\nMMIO SPTE due to a _guest_ write, it failed to account for writes to guest\nmemory that are outside the scope of KVM.\n\nE.g. if host userspace modifies a shadowed gPTE to switch from a memslot\nto emulted MMIO and then the guest hits a relevant page fault, KVM will\ninstall the MMIO SPTE without first zapping the shadow-present SPTE.\n\n  ------------[ cut here ]------------\n  is_shadow_present_pte(*sptep)\n  WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   mmu_set_spte+0x237/0x440 [kvm]\n   ept_page_fault+0x535/0x7f0 [kvm]\n   kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]\n   kvm_mmu_page_fault+0x8d/0x620 [kvm]\n   vmx_handle_exit+0x18c/0x5a0 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb5/0x730\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x47fa3f\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:11.775Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20656cd1f243d3a154aac5dd1b823110b6906fe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed5909992f344a7d3f4024261e9f751d9618a27d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd28c5618699180cd69619801e9ae6a5266c0a22"
        },
        {
          "url": "https://git.kernel.org/stable/c/459158151a158a6703b49f3c9de0e536d8bd553f"
        },
        {
          "url": "https://git.kernel.org/stable/c/695320de6eadb75aaed8be1787c4ce4c189e4c7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bce7fe59d43531623f3e43779127bfb33804925d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aad885e774966e97b675dfe928da164214a71605"
        }
      ],
      "title": "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23401",
    "datePublished": "2026-04-01T08:36:32.367Z",
    "dateReserved": "2026-01-13T15:37:46.012Z",
    "dateUpdated": "2026-11-05T21:33:45.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31402 (GCVE-0-2026-31402)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:16 – Updated: 2026-11-10 12:43

Title

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting lock owner as a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). When a LOCK operation is denied due to a conflict with an existing lock that has a large owner, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() with no bounds check. This results in a slab-out-of-bounds write of up to 944 bytes past the end of the buffer, corrupting adjacent heap memory. This can be triggered remotely by an unauthenticated attacker with two cooperating NFSv4.0 clients: one sets a lock with a large owner string, then the other requests a conflicting lock to provoke the denial. We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full opaque, but that would increase the size of every stateowner, when most lockowners are not that large. Instead, fix this by checking the encoded response length against NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the response is too large, set rp_buflen to 0 to skip caching the replay payload. The status is still cached, and the client already received the correct response on the original request.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:08 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-122 - Heap-based Buffer Overflow

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

38 references

URL	Tags
https://git.kernel.org/stable/c/f9fcb4441f6c02bb2…
https://git.kernel.org/stable/c/2665887a69437a8a4…
https://git.kernel.org/stable/c/c9452c0797c95cf23…
https://git.kernel.org/stable/c/8afb437ea1f70cacb…
https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6e…
https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad…
https://git.kernel.org/stable/c/ae8498337dfdfda71…
https://git.kernel.org/stable/c/5133b61aaf437e5f2…
https://access.redhat.com/security/cve/CVE-2026-31402	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2454844	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:14823	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14925	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14869	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15883	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13566	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19569	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13936	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13734	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10108	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11313	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13565	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13577	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14165	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13664	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13681	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36532	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36533	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13578	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14137	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14301	vendor-advisoryx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

44 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f9fcb4441f6c02bb20c2eb340101e27dfe23607c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2665887a69437a8a4f552f69509eecfb73d4aa19 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c9452c0797c95cf2378170df96cf4f4b3bca7eff (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8afb437ea1f70cacb4bbdf11771fb5c4d720b965 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0f0e2a54a31a7f9ad2915db99156114872317388 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ae8498337dfdfda71bdd0b807c9a23a126011d76 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5133b61aaf437e5f25b1b396b14242a6bb0508e2 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.18.20 , ≤ 6.18.* (semver) Unaffected: 6.19.10 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-124.55.1.el10_1 , < * (rpm) Unaffected: 0:6.12.0-211.16.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.72.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	Unaffected: 0:2.6.32-754.60.1.el6 , < * (rpm) cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.149.1.rt56.1301.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.149.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.123.1.rt7.464.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.123.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.190.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.190.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.190.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:4.18.0-372.190.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:4.18.0-372.190.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.139.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.139.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-611.54.1.el9_7 , < * (rpm) Unaffected: 0:5.14.0-687.10.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:5.14.0-70.178.1.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:5.14.0-70.178.1.rt21.250.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.169.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.169.1.rt14.454.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:5.14.0-427.121.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.110.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.7 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-124.55.1.el10_1",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.16.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.72.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.32-754.60.1.el6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.149.1.rt56.1301.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.149.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.123.1.rt7.464.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.123.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.190.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.190.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.190.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.190.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.190.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.139.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.139.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-611.54.1.el9_7",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.10.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-70.178.1.el9_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-70.178.1.rt21.250.el9_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.169.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.169.1.rt14.454.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.121.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.110.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-03T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s NFSv4.0 server (nfsd). A remote, unauthenticated attacker can exploit this heap overflow vulnerability in the NFSv4.0 LOCK replay cache. By using two cooperating NFSv4.0 clients, where one sets a lock with a large owner string and another requests a conflicting lock, the attacker can trigger a slab-out-of-bounds write. This corruption of adjacent heap memory could lead to arbitrary code execution or a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:09:25.508Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31402"
          },
          {
            "name": "RHBZ#2454844",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454844"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31402.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14823"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14925"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14869"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:15883"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13566"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19569"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13936"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13734"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10108"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11313"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13565"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19568"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13577"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36530"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14165"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13664"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13681"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36532"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36533"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36534"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13578"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14137"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:14301"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:14823: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14925: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14869: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:15883: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13566: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13936: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13734: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10108: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11313: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13565: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13577: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36530: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14165: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13664: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13681: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36531: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36532: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36533: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36534: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13578: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14137: Red Hat Enterprise Linux NFV E4S (v.9.0), Red Hat Enterprise Linux Real Time E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:14301: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-03T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-03T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T12:43:53.041Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31402",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:08:51.430825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-122",
                "description": "CWE-122 Heap-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:46.793Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9fcb4441f6c02bb20c2eb340101e27dfe23607c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2665887a69437a8a4f552f69509eecfb73d4aa19",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c9452c0797c95cf2378170df96cf4f4b3bca7eff",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8afb437ea1f70cacb4bbdf11771fb5c4d720b965",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0f0e2a54a31a7f9ad2915db99156114872317388",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ae8498337dfdfda71bdd0b807c9a23a126011d76",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5133b61aaf437e5f25b1b396b14242a6bb0508e2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached by remote NFSv4.0 COMPOUND/LOCK RPCs handled by nfsd over the network. The trigger uses two cooperating NFS clients to create a conflicting lock response.\nAC:L - The attacker controls the lockowner string length and can create both the original lock and the conflicting LOCK request; there is no race or external timing condition. Normal NFSv4.0 client-state setup is deterministic.\nPR:N - No local privileges or kernel capabilities are needed; an unauthenticated network client can reach this on an accessible NFSv4.0 export using ordinary RPC client setup. For the most severe reasonable deployment, AUTH_SYS/export access does not require a preexisting account.\nUI:N - Exploitation only requires sending crafted NFS RPC traffic to the server. No user or administrator interaction is required once nfsd and the export are available.\nS:U - The corruption occurs in the kernel NFS server and impacts the same host/kernel security authority. It does not cross a separate boundary such as guest-to-host virtualization or IOMMU isolation.\nC:H - The bug is kernel heap memory corruption from copying an oversized encoded LOCK denial into a fixed replay buffer. Such corruption can plausibly be shaped into information disclosure, so high confidentiality impact is the higher defensible choice.\nI:H - This is an out-of-bounds heap write of up to hundreds of bytes past the replay buffer into adjacent slab memory. Kernel heap corruption is plausibly exploitable for arbitrary modification or code execution.\nA:H - The same out-of-bounds write can corrupt adjacent kernel objects and reliably crash or panic the NFS server host. It can also be triggered remotely and repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:10.166Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9fcb4441f6c02bb20c2eb340101e27dfe23607c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2665887a69437a8a4f552f69509eecfb73d4aa19"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9452c0797c95cf2378170df96cf4f4b3bca7eff"
        },
        {
          "url": "https://git.kernel.org/stable/c/8afb437ea1f70cacb4bbdf11771fb5c4d720b965"
        },
        {
          "url": "https://git.kernel.org/stable/c/dad0c3c0a8e5d1d6eb0fc455694ce3e25e6c57d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f0e2a54a31a7f9ad2915db99156114872317388"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae8498337dfdfda71bdd0b807c9a23a126011d76"
        },
        {
          "url": "https://git.kernel.org/stable/c/5133b61aaf437e5f25b1b396b14242a6bb0508e2"
        }
      ],
      "title": "nfsd: fix heap overflow in NFSv4.0 LOCK replay cache",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31402",
    "datePublished": "2026-04-03T15:16:05.724Z",
    "dateReserved": "2026-03-09T15:48:24.086Z",
    "dateUpdated": "2026-11-10T12:43:53.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31408 (GCVE-0-2026-31408)

Vulnerability from cvelistv5 – Published: 2026-04-06 07:38 – Updated: 2026-10-19 18:35

Title

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:09 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/37e18bc8c9a70d77b…
https://git.kernel.org/stable/c/d57384e27d1ebf004…
https://git.kernel.org/stable/c/b0a7da0e3f7442545…
https://git.kernel.org/stable/c/45aaca995e4a7a05b…
https://git.kernel.org/stable/c/108b81514d8f2535e…
https://git.kernel.org/stable/c/7197462e90b8ce15c…
https://git.kernel.org/stable/c/e76e8f0581ef555ea…
https://git.kernel.org/stable/c/598dbba9919c5e36c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d57384e27d1ebf0047e3f00a6e1181b8be9857a2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b0a7da0e3f7442545f071499beb36374714bb9de (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 108b81514d8f2535eb16651495cefb2250528db3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e76e8f0581ef555eacc11dbb095e602fb30a5361 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 598dbba9919c5e36c54fe1709b557d64120cb94b (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:09:03.338755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:47.242Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d57384e27d1ebf0047e3f00a6e1181b8be9857a2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b0a7da0e3f7442545f071499beb36374714bb9de",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "45aaca995e4a7a05b272a58e7ab2fff4f611b8f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "108b81514d8f2535eb16651495cefb2250528db3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e76e8f0581ef555eacc11dbb095e602fb30a5361",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "598dbba9919c5e36c54fe1709b557d64120cb94b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold\n\nsco_recv_frame() reads conn-\u003esk under sco_conn_lock() but immediately\nreleases the lock without holding a reference to the socket. A concurrent\nclose() can free the socket between the lock release and the subsequent\nsk-\u003esk_state access, resulting in a use-after-free.\n\nOther functions in the same file (sco_sock_timeout(), sco_conn_del())\ncorrectly use sco_sock_hold() to safely hold a reference under the lock.\n\nFix by using sco_sock_hold() to take a reference before releasing the\nlock, and adding sock_put() on all exit paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Incoming Bluetooth SCO/eSCO data reaches the vulnerable function through the HCI receive path, so the attacker must be within Bluetooth radio range. This is adjacent-network reachability, not IP network or physical-device access.\nAC:L - The bug is a use-after-free race between received SCO data and socket close/teardown, and an attacker can repeatedly drive SCO traffic while provoking endpoint teardown to hit the window. No rare configuration or uncontrollable memory layout condition is required beyond Bluetooth SCO support.\nPR:N - The Bluetooth peer sending SCO data needs no account or privileges on the target system, and the per-packet receive path has no capability or authentication check. Incoming acceptance depends on Bluetooth connection/listening state, not target-user privileges held by the attacker.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an explicit action. Once the Bluetooth/SCO endpoint is active, packets and teardown can be driven by protocol activity.\nS:U - The vulnerability is in the kernel Bluetooth stack and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a kernel use-after-free of a socket object, and subsequent code dereferences the freed sock and can pass it into receive-queue handling. Such heap UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is high.\nI:H - The freed sock pointer can be used in `sock_queue_rcv_skb()`, which updates socket queues/state and can invoke socket callbacks after reuse. This is kernel memory corruption with plausible control-flow or arbitrary-write exploitation, so integrity impact is high.\nA:H - Even without full exploitation, dereferencing and operating on a freed kernel socket can cause an oops, panic, or memory corruption crash. Availability impact is therefore high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:27:56.705Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0a7da0e3f7442545f071499beb36374714bb9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/108b81514d8f2535eb16651495cefb2250528db3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e76e8f0581ef555eacc11dbb095e602fb30a5361"
        },
        {
          "url": "https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b"
        }
      ],
      "title": "Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31408",
    "datePublished": "2026-04-06T07:38:20.533Z",
    "dateReserved": "2026-03-09T15:48:24.086Z",
    "dateUpdated": "2026-10-19T18:35:47.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31607 (GCVE-0-2026-31607)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:42 – Updated: 2026-10-19 18:56

Title

usbip: validate number_of_packets in usbip_pack_ret_submit()

Summary

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region. KASAN confirmed this with kernel 7.0.0-rc5: BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 The buggy address is located 0 bytes to the right of allocated 320-byte region [ffff888106351c00, ffff888106351d40) The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original number_of_packets. This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size. Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbip_recv_iso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit. Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:11 UTC

CWE

CWE-805 - Buffer Access with Incorrect Length Value
CWE-787 - Out-of-bounds Write

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

18 references

URL	Tags
https://git.kernel.org/stable/c/324262c38438255bf…
https://git.kernel.org/stable/c/973f2c250289f5bf6…
https://git.kernel.org/stable/c/ce744264b06b97069…
https://git.kernel.org/stable/c/885c8591784da6314…
https://git.kernel.org/stable/c/8d155e2d1c4102f74…
https://git.kernel.org/stable/c/906f16a836de13fe6…
https://git.kernel.org/stable/c/ef8ebb1c637b4cfb6…
https://git.kernel.org/stable/c/5e1c4ece08ccdc197…
https://git.kernel.org/stable/c/2ab833a16a825373a…
https://access.redhat.com/security/cve/CVE-2026-31607	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2461521	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:25095	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24343	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19569	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19568	vendor-advisoryx_refsource_REDHAT

Impacted products

11 products

Vendor	Product	Version
Linux	Linux	Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 324262c38438255bf6bdbf6342ca47c0badaab76 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 973f2c250289f5bf6cc146b98aa6fdde11fe50d6 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < ce744264b06b97069b3722511ab355738311fee0 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 885c8591784da6314f9aa82fa460ac69f9f79e5f (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 8d155e2d1c4102f74f82a2bf9c016164bb0f7384 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 906f16a836de13fe61f49cdce2f66f2dbd14caf4 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < ef8ebb1c637b4cfb61a9dd2e013376774ee2033b (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 5e1c4ece08ccdc197177631f111845a2c68eede3 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 2ab833a16a825373aad2ba7d54b572b277e95b71 (git) Affected: d9638d9236eed035a575feddec61d036dacc2676 (git) Affected: ca7d3501b7a287c18b5b470e871d3029b0f4842a (git) Affected: 1ce528277e1a66856ed3f7526c1e3458c0ed4a70 (git) Affected: db898d0c5c493ce4177d5e1d3a953e079a56a24b (git) Affected: 5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a (git) Affected: 2.6.32.37 , < 2.6.33 (semver) Affected: 2.6.33.10 , < 2.6.34 (semver) Affected: 2.6.34.11 , < 2.6.35 (semver) Affected: 2.6.35.13 , < 2.6.36 (semver) Affected: 2.6.38.3 , < 2.6.39 (semver)
Linux	Linux	Affected: 2.6.39 Unaffected: 0 , < 2.6.39 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0.1 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.16.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.77.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.155.1.rt56.1307.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.151.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.10.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.119.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.16.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.77.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.155.1.rt56.1307.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.151.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.10.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.119.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-805",
                "description": "Buffer Access with Incorrect Length Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T12:13:01.495Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31607"
          },
          {
            "name": "RHBZ#2461521",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461521"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25095"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24343"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19569"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19568"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:25095: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, prevent the `usbip` kernel module from loading by blacklisting it. Create a file named `/etc/modprobe.d/blacklist-usbip.conf` with the following content:\n\n```\nblacklist usbip\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on USB/IP."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31607",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:11:11.271174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:56:00.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/usbip_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "324262c38438255bf6bdbf6342ca47c0badaab76",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "973f2c250289f5bf6cc146b98aa6fdde11fe50d6",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "ce744264b06b97069b3722511ab355738311fee0",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "885c8591784da6314f9aa82fa460ac69f9f79e5f",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "8d155e2d1c4102f74f82a2bf9c016164bb0f7384",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "906f16a836de13fe61f49cdce2f66f2dbd14caf4",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "ef8ebb1c637b4cfb61a9dd2e013376774ee2033b",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "5e1c4ece08ccdc197177631f111845a2c68eede3",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "2ab833a16a825373aad2ba7d54b572b277e95b71",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9638d9236eed035a575feddec61d036dacc2676",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca7d3501b7a287c18b5b470e871d3029b0f4842a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1ce528277e1a66856ed3f7526c1e3458c0ed4a70",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db898d0c5c493ce4177d5e1d3a953e079a56a24b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.33",
              "status": "affected",
              "version": "2.6.32.37",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.34",
              "status": "affected",
              "version": "2.6.33.10",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.35",
              "status": "affected",
              "version": "2.6.34.11",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.36",
              "status": "affected",
              "version": "2.6.35.13",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.39",
              "status": "affected",
              "version": "2.6.38.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/usbip_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.32.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.33.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.34.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.35.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.38.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb-\u003enumber_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb-\u003eiso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb-\u003eiso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n  BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n  Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n  The buggy address is located 0 bytes to the right of\n   allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo\u0027s series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu-\u003enumber_of_packets against\nurb-\u003enumber_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable client-side VHCI path processes USB/IP RET_SUBMIT responses received over a TCP socket from a remote USB/IP server. A malicious or compromised server can send the crafted network PDU; physical USB access is not required.\nAC:L - No race or hard-to-control condition is required; the server sees the client CMD_SUBMIT sequence number and can reply with an oversized number_of_packets. The attacker can reasonably present or service an isochronous USB device to reach the iso descriptor path.\nPR:N - The attacker needs no privileges on the vulnerable client system and USB/IP has no authentication gate in this kernel receive path. Once acting as the remote peer, the server-controlled RET_SUBMIT fields are accepted by vhci_rx.\nUI:N - In a reasonable high-impact deployment, the USB/IP client connection may already be established or automatically managed. Exploitation is then triggered solely by the remote server\u2019s response packet without further victim action.\nS:U - The corruption occurs in the client kernel and impacts resources governed by the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is heap memory corruption caused by attacker-controlled iso descriptors being written past the allocated urb-\u003eiso_frame_desc array. Such kernel memory corruption can be leveraged for information disclosure primitives, so confidentiality impact is high.\nI:H - usbip_recv_iso writes attacker-controlled descriptor fields out of bounds into adjacent kernel heap memory. This is a controlled kernel heap overwrite with plausible code execution or privilege escalation impact.\nA:H - KASAN confirmed a slab out-of-bounds write in the vhci_rx kernel thread. Even without full exploitation, a malicious server can crash or destabilize the kernel, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:45.870Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"
        },
        {
          "url": "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"
        },
        {
          "url": "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"
        },
        {
          "url": "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"
        }
      ],
      "title": "usbip: validate number_of_packets in usbip_pack_ret_submit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31607",
    "datePublished": "2026-04-24T14:42:29.468Z",
    "dateReserved": "2026-03-09T15:48:24.122Z",
    "dateUpdated": "2026-10-19T18:56:00.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:19569

BDU:2026-12288 (CVE-2026-23270)

CVE-2024-56603 (GCVE-0-2024-56603)

CVE-2025-39766 (GCVE-0-2025-39766)

CVE-2025-68724 (GCVE-0-2025-68724)

CVE-2025-68741 (GCVE-0-2025-68741)

CVE-2026-23270 (GCVE-0-2026-23270)

CVE-2026-23401 (GCVE-0-2026-23401)

CVE-2026-31402 (GCVE-0-2026-31402)

CVE-2026-31408 (GCVE-0-2026-31408)

CVE-2026-31607 (GCVE-0-2026-31607)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour