Vulnerability-Lookup

RHSA-2026:39371

Vulnerability from csaf_redhat - Published: 2026-07-14 17:07 - Updated: 2026-11-09 22:56

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-38653

A flaw was found in the Linux kernel's procfs file system. This flaw allows a local user to cause a Denial of Service (DoS) by triggering a kernel crash. The issue occurs due to a race condition when a file under the /proc directory is accessed while its associated kernel module is unloaded, leading to a use-after-free (UAF) condition. A local attacker could exploit this timing gap to destabilize or crash the operating system.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 307 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debug-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debug-devel-matched-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-64k-devel-matched-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debug-devel-matched-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-ppc64le-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-s390x-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-devel-matched-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-doc-0:6.12.0-55.88.1.el10_0.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-zfcpdump-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-zfcpdump-devel-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:kernel-zfcpdump-devel-matched-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rtla-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.0.Z.E2S:rv-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.88.1.el10_0.src	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debug-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-64k-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-abi-stablelists-0:6.12.0-55.88.1.el10_0.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-modules-extra-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debug-uki-virt-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-ppc64le-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-s390x-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-modules-extra-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-libs-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-libs-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-tools-libs-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-addons-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-uki-virt-addons-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-core-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-modules-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-modules-core-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:kernel-zfcpdump-modules-extra-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-ppc64le-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-s390x-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-libs-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-libs-devel-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-tools-libs-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:kernel-zfcpdump-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-kvm-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-modules-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-modules-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debug-modules-extra-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-kvm-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-modules-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-modules-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-rt-modules-extra-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-common-aarch64-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-debuginfo-common-x86_64-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debug-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-64k-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debug-modules-extra-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-devel-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-devel-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-core-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-core-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-extra-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-rt-modules-extra-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:kernel-tools-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.0.Z.E2S:python3-perf-debuginfo-0:6.12.0-55.88.1.el10_0.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-68183

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem. When modifying non-IMA extended attributes, such as security labels or access control lists on a file, the kernel inadvertently clears an internal digital signature flag. A local user can exploit this behavior during file attribute operations to cause the kernel to overwrite an existing digital signature with a basic cryptographic digest upon file closure. This weakens file integrity appraisal guarantees by reducing signature verification to basic hash validation.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-354 - Improper Validation of Integrity Check Value

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2025-68724

A flaw was found in the Linux kernel's asymmetric keys subsystem. An integer overflow in the asymmetric_key_generate_id function can lead to memory corruption when calculating buffer sizes for asymmetric key identifiers. A local attacker with privileges to load cryptographic certificates into the kernel keyring could exploit this flaw by providing a crafted X.509 certificate with oversized fields. This could result in a Denial of Service (DoS) through a system crash or unauthorized memory disclosure.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-31408

A flaw was found in the Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) protocol implementation. The `sco_recv_frame()` function fails to properly hold a reference to a socket after releasing a lock. This oversight allows a concurrent operation to free the socket while it is still being accessed, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause memory corruption or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-43027

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the `nf_conntrack_helper`. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. A local attacker could exploit this to cause a system crash, resulting in a Denial of Service (DoS), or potentially achieve privilege escalation.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-459 - Incomplete Cleanup

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-43074

A flaw was found in the Linux kernel's `eventpoll` component. In certain situations, the `ep_free()` function in `eventpoll.c` can prematurely free the `eventpoll` data structure while it is still being used by another concurrent thread. This use-after-free (UAF) vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-43330

A flaw was found in the Linux kernel's caam cryptographic accelerator driver. When processing a Hash-based Message Authentication Code (HMAC) key that exceeds the block size, the driver incorrectly handles memory allocation and copying. This can lead to an overflow, where the system attempts to read beyond the intended memory buffer, potentially corrupting neighboring memory. This memory corruption could lead to system instability or denial of service.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-43414

A flaw was found in the Linux kernel's `qla2xxx` SCSI driver. An issue exists where a Fibre Channel port (fcport) object can be freed twice due to an error in the `qla2x00_els_dcmd_sp_free()` function. This double free vulnerability can lead to memory corruption, potentially causing system instability or a denial of service.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-46113

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) x86 shadow paging mechanism. This use-after-free vulnerability arises from incorrect handling of Guest Frame Numbers (GFNs) when guest page tables are modified. A local attacker with control over a guest virtual machine could exploit this to dereference freed memory, potentially leading to information disclosure, privilege escalation, or a denial of service (DoS).

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-46116

A flaw was found in the Linux kernel's `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-46135

A flaw was found in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. A race condition exists between the handling of an Initialization Connection Request (ICReq) and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a double free vulnerability. This could lead to a denial of service (DoS) due to memory corruption.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-46173

A flaw was found in the Linux kernel. During the exit process of a task that has encountered an error, the system can incorrectly allow the task to be interrupted. This can lead to improper management of the task's memory, potentially causing memory corruption. Such an issue could allow a local attacker to cause a system crash (Denial of Service) or potentially gain elevated privileges.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-46242

A flaw was found in the Linux kernel's `eventpoll` mechanism. A Use-After-Free (UAF) vulnerability, where the system attempts to access memory after it has been freed, can occur during the removal of a file. A local attacker could exploit this race condition to corrupt memory, potentially leading to privilege escalation or arbitrary code execution. This allows an attacker to gain elevated control over the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-46316

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64, specifically within the vgic-its component. This vulnerability occurs when multiple concurrent operations incorrectly drop the translation cache's reference to an entry more than once during cache invalidation. This leads to a use-after-free condition, which can result in memory corruption. The primary impact is potential system instability or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-53359

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry (PDE) mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a use-after-free condition, where the system attempts to access memory that has already been released. Such a condition can lead to system instability, denial of service, potentially the execution of arbitrary code or guest-to-host escape.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 307 products, the same list as for CVE-2025-38653

Threats

Impact Important

References

94 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:39371	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2390372	external
https://bugzilla.redhat.com/show_bug.cgi?id=2422699	external
https://bugzilla.redhat.com/show_bug.cgi?id=2424886	external
https://bugzilla.redhat.com/show_bug.cgi?id=2455334	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464369	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467019	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468061	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468155	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482634	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482654	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483519	external
https://bugzilla.redhat.com/show_bug.cgi?id=2486982	external
https://bugzilla.redhat.com/show_bug.cgi?id=2497033	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-38653	self
https://bugzilla.redhat.com/show_bug.cgi?id=2390372	external
https://www.cve.org/CVERecord?id=CVE-2025-38653	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38653	external
https://lore.kernel.org/linux-cve-announce/202508…	external
https://access.redhat.com/security/cve/CVE-2025-68183	self
https://bugzilla.redhat.com/show_bug.cgi?id=2422699	external
https://www.cve.org/CVERecord?id=CVE-2025-68183	external
https://nvd.nist.gov/vuln/detail/CVE-2025-68183	external
https://lore.kernel.org/linux-cve-announce/202512…	external
https://access.redhat.com/security/cve/CVE-2025-68724	self
https://bugzilla.redhat.com/show_bug.cgi?id=2424886	external
https://www.cve.org/CVERecord?id=CVE-2025-68724	external
https://nvd.nist.gov/vuln/detail/CVE-2025-68724	external
https://lore.kernel.org/linux-cve-announce/202512…	external
https://access.redhat.com/security/cve/CVE-2026-31408	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455334	external
https://www.cve.org/CVERecord?id=CVE-2026-31408	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31408	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-43027	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464369	external
https://www.cve.org/CVERecord?id=CVE-2026-43027	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43027	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43074	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467019	external
https://www.cve.org/CVERecord?id=CVE-2026-43074	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43074	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43330	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468061	external
https://www.cve.org/CVERecord?id=CVE-2026-43330	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43330	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-43414	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468155	external
https://www.cve.org/CVERecord?id=CVE-2026-43414	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43414	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46113	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482587	external
https://www.cve.org/CVERecord?id=CVE-2026-46113	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46113	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46116	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482523	external
https://www.cve.org/CVERecord?id=CVE-2026-46116	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46116	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46135	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482654	external
https://www.cve.org/CVERecord?id=CVE-2026-46135	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46135	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46173	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482634	external
https://www.cve.org/CVERecord?id=CVE-2026-46173	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46173	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46242	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483519	external
https://www.cve.org/CVERecord?id=CVE-2026-46242	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46242	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46316	self
https://bugzilla.redhat.com/show_bug.cgi?id=2486982	external
https://www.cve.org/CVERecord?id=CVE-2026-46316	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46316	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-53359	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497033	external
https://www.cve.org/CVERecord?id=CVE-2026-53359	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53359	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://www.openwall.com/lists/oss-security/2026/…	external

JSON

To clipboard

Loading 1.6 MB of JSON…

BDU:2026-11328 (CVE-2026-46116)

Vulnerability from fstec – Published: 2026-08-10 – Updated: 2026-10-08 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции __xfrm_state_delete() модуля net/xfrm/xfrm_state.c реализации сетевых функций ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции __xfrm_state_delete() модуля net/xfrm/xfrm_state.c реализации сетевых функций ядра операционной системы Linux связана с использованием памяти после ее освобождения. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-416 - Использование после освобождения
CWE-763 - Освобождение неверного указателя или ссылки

Aliases

CVE-2026-46116, RHSA-2026:36018, RHSA-2026:39179, RHSA-2026:39180, RHSA-2026:39371, RHSA-2026:41234, RHSA-2026:41235, RHSA-2026:42919, RHSA-2026:43231, RHSA-2026:44385, RHSA-2026:47632, RHSA-2026:47633, RHSA-2026:47739, RHSA-2026:47869, RHSA-2026:49033, 4665-1, 4671-1, 4717-1

References

13 references

URL
https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3
https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0
https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc
https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8
https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050
https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6
https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5
https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182
https://security-tracker.debian.org/tracker/CVE-2026-46116
https://access.redhat.com/security/cve/cve-2026-46116
https://ubuntu.com/security/CVE-2026-46116
https://altsp.su/obnovleniya-bezopasnosti/
https://redos.red-soft.ru/support/secure/

Impacted products

7 products from 7 vendors

Vendors

Canonical Ltd., Red Hat, Inc., Сообщество свободного программного обеспечения, ООО «Ред Софт», АО «ИВК», ООО «КНС ГРУПП»

Products

Ubuntu, Red Hat Enterprise Linux, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), Альт 8 СП (запись в едином реестре российских программ №4305), Linux, Татлин-Обджект (запись в едином реестре российских программ №15452)

Versions

16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (РЕД ОС), - (Альт 8 СП), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.6 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), 9.6 Extended Update Support (Red Hat Enterprise Linux), 8.0 (РЕД ОС), 10.0 Extended Update Support (Red Hat Enterprise Linux), 26.04 LTS (Ubuntu), от 6.19 до 7.0.7 (Linux), 9.4 Update Services for SAP Solutions (Red Hat Enterprise Linux), от 5.16 до 6.1.176 (Linux), до 1.12 (Татлин-Обджект), от 6.13 до 6.18.30 (Linux), 7.1 rc1 (Linux), 7.1 rc2 (Linux), от 6.2 до 6.6.140 (Linux), от 6.7 до 6.12.88 (Linux), от 2.6.19 до 5.15.210 (Linux)

Product types

Operating system, Appliance software

Platforms

Canonical Ltd. Ubuntu 16.04 LTS, Canonical Ltd. Ubuntu 18.04 LTS, Red Hat, Inc. Red Hat Enterprise Linux 8, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), АО «ИВК» Альт 8 СП - (запись в едином реестре российских программ №4305), Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support, Inc. Red Hat Enterprise Linux 10, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Сообщество свободного программного обеспечения Debian GNU/Linux 13, Inc. Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751), Inc. Red Hat Enterprise Linux 10.0 Extended Update Support, Canonical Ltd. Ubuntu 26.04 LTS, Сообщество свободного программного обеспечения Linux от 6.19 до 7.0.7, Inc. Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Сообщество свободного программного обеспечения Linux от 5.16 до 6.1.176, Сообщество свободного программного обеспечения Linux от 6.13 до 6.18.30, Сообщество свободного программного обеспечения Linux 7.1 rc1, Сообщество свободного программного обеспечения Linux 7.1 rc2, Сообщество свободного программного обеспечения Linux от 6.2 до 6.6.140, Сообщество свободного программного обеспечения Linux от 6.7 до 6.12.88, Сообщество свободного программного обеспечения Linux от 2.6.19 до 5.15.210

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3 https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0 https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8 https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050 https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6 https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5 https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-46116 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2026-46116 Для Ubuntu: https://ubuntu.com/security/CVE-2026-46116 Для программного обеспечения «Татлин-Обджект»: обновление до версии 1.12 Для ОС Альт 8 СП: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/ Для Ред ОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/ Для Ред ОС: http://repo.red-soft.ru/redos/8.0/aarch64/updates/

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Red Hat, Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, \u041e\u041e\u041e \u00ab\u041a\u041d\u0421 \u0413\u0420\u0423\u041f\u041f\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), - (\u0410\u043b\u044c\u0442 8 \u0421\u041f), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 8.6 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), 9.6 Extended Update Support (Red Hat Enterprise Linux), 8.0 (\u0420\u0415\u0414 \u041e\u0421), 10.0 Extended Update Support (Red Hat Enterprise Linux), 26.04 LTS (Ubuntu), \u043e\u0442 6.19 \u0434\u043e 7.0.7 (Linux), 9.4 Update Services for SAP Solutions (Red Hat Enterprise Linux), \u043e\u0442 5.16 \u0434\u043e 6.1.176 (Linux), \u0434\u043e 1.12 (\u0422\u0430\u0442\u043b\u0438\u043d-\u041e\u0431\u0434\u0436\u0435\u043a\u0442), \u043e\u0442 6.13 \u0434\u043e 6.18.30 (Linux), 7.1 rc1 (Linux), 7.1 rc2 (Linux), \u043e\u0442 6.2 \u0434\u043e 6.6.140 (Linux), \u043e\u0442 6.7 \u0434\u043e 6.12.88 (Linux), \u043e\u0442 2.6.19 \u0434\u043e 5.15.210 (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3\nhttps://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0\nhttps://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc\nhttps://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8\t\nhttps://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050 \nhttps://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6\nhttps://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5\nhttps://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-46116\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-46116\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2026-46116\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u00ab\u0422\u0430\u0442\u043b\u0438\u043d-\u041e\u0431\u0434\u0436\u0435\u043a\u0442\u00bb:\n\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.12\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u043b\u044c\u0442 8 \u0421\u041f: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430: https://altsp.su/obnovleniya-bezopasnosti/\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/8.0/x86_64/updates/\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/8.0/aarch64/updates/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.05.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "08.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "10.08.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-11328",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-46116, RHSA-2026:36018, RHSA-2026:39179, RHSA-2026:39180, RHSA-2026:39371, RHSA-2026:41234, RHSA-2026:41235, RHSA-2026:42919, RHSA-2026:43231, RHSA-2026:44385, RHSA-2026:47632, RHSA-2026:47633, RHSA-2026:47739, RHSA-2026:47869, RHSA-2026:49033, 4665-1, 4671-1, 4717-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Red Hat Enterprise Linux, Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u0410\u043b\u044c\u0442 8 \u0421\u041f (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164305), Linux, \u0422\u0430\u0442\u043b\u0438\u043d-\u041e\u0431\u0434\u0436\u0435\u043a\u0442 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211615452)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 16.04 LTS , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u043b\u044c\u0442 8 \u0421\u041f -  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164305), Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support , Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support , Red Hat, Inc. Red Hat Enterprise Linux 10 , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On , Red Hat, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Red Hat, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support , Canonical Ltd. Ubuntu 26.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19 \u0434\u043e 7.0.7 , Red Hat, Inc. Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.16 \u0434\u043e 6.1.176 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.13 \u0434\u043e 6.18.30 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux 7.1 rc1 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux 7.1 rc2 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.2 \u0434\u043e 6.6.140 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7 \u0434\u043e 6.12.88 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 2.6.19 \u0434\u043e 5.15.210 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __xfrm_state_delete() \u043c\u043e\u0434\u0443\u043b\u044f net/xfrm/xfrm_state.c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416), \u041e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u0435\u0440\u043d\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u0441\u0441\u044b\u043b\u043a\u0438 (CWE-763)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __xfrm_state_delete() \u043c\u043e\u0434\u0443\u043b\u044f net/xfrm/xfrm_state.c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3\nhttps://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0\nhttps://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc\nhttps://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8\t\nhttps://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050 \nhttps://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6\nhttps://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5\nhttps://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182\nhttps://security-tracker.debian.org/tracker/CVE-2026-46116\nhttps://access.redhat.com/security/cve/cve-2026-46116\nhttps://ubuntu.com/security/CVE-2026-46116\nhttps://altsp.su/obnovleniya-bezopasnosti/\nhttps://redos.red-soft.ru/support/secure/\nhttps://redos.red-soft.ru/support/secure/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416, CWE-763",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2025-38653 (GCVE-0-2025-38653)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:00 – Updated: 2026-10-15 22:02

Title

proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

Summary

In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:52 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/c35b0feb80b48720d…
https://git.kernel.org/stable/c/33c778ea0bd0fa62f…
https://git.kernel.org/stable/c/fc1072d934f687e12…
https://git.kernel.org/stable/c/d136502e04d8853a9…
https://git.kernel.org/stable/c/1fccbfbae1dd36198…
https://git.kernel.org/stable/c/ff7ec8dc1b646296f…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < c35b0feb80b48720dfbbf4e33759c7be3faaebb6 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < 33c778ea0bd0fa62ff590497e72562ff90f82b13 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < fc1072d934f687e1221d685cf1a49a5068318f34 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < d136502e04d8853a9aecb335d07bbefd7a1519a8 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < 1fccbfbae1dd36198dc47feac696563244ad81d3 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < ff7ec8dc1b646296f8d94c39339e8d3833d16c05 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.148 , ≤ 6.1.* (semver) Unaffected: 6.6.102 , ≤ 6.6.* (semver) Unaffected: 6.12.42 , ≤ 6.12.* (semver) Unaffected: 6.15.10 , ≤ 6.15.* (semver) Unaffected: 6.16.1 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:46.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:52:33.974693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:27.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/generic.c",
            "fs/proc/inode.c",
            "fs/proc/internal.h",
            "include/linux/proc_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c35b0feb80b48720dfbbf4e33759c7be3faaebb6",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "33c778ea0bd0fa62ff590497e72562ff90f82b13",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "fc1072d934f687e1221d685cf1a49a5068318f34",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "d136502e04d8853a9aecb335d07bbefd7a1519a8",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "1fccbfbae1dd36198dc47feac696563244ad81d3",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "ff7ec8dc1b646296f8d94c39339e8d3833d16c05",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/generic.c",
            "fs/proc/inode.c",
            "fs/proc/internal.h",
            "include/linux/proc_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al\n\nCheck pde-\u003eproc_ops-\u003eproc_lseek directly may cause UAF in rmmod scenario. \nIt\u0027s a gap in proc_reg_open() after commit 654b33ada4ab(\"proc: fix UAF in\nproc_get_inode()\").  Followed by AI Viro\u0027s suggestion, fix it in same\nmanner."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the open(2) syscall on a procfs entry, requiring local access to the system. There is no network-facing path to proc_reg_open().\nAC:L - The attacker fully controls their side of the race and can spin unbounded threads on open(), while widening the lookup-to-open window with memory pressure since proc_get_inode() allocates GFP_KERNEL; on Android/embedded targets the module-teardown side is also reachable by toggling user-facing device state (WiFi/BT/camera), so the race can be provoked at will.\nPR:L - Any unprivileged local user can open a world-readable module-created /proc entry (e.g. /proc/net/*, /proc/scsi/*, /proc/driver/*); the unguarded dereference happens before any capability or use_pde() gate.\nUI:N - The attacker\u0027s own open() performs the faulty dereference; no victim needs to open a file, mount a filesystem, or otherwise interact.\nS:U - The use-after-free occurs in kernel memory and its impact stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of freed module memory through a dangling pde-\u003eproc_ops pointer, and freed-region contents that an attacker can groom (by triggering module loads that recycle the region) are consumed by the kernel and leak back through the resulting FMODE_LSEEK state.\nI:H - Use-after-free of a function-pointer table entry means kernel control-flow-relevant data is read from memory whose contents an attacker may influence via heap/module-region grooming, and such UAF conditions are treated as exploitable for corruption of kernel state.\nA:H - The dereference targets vmalloc-backed module memory that is unmapped on free, producing the same kernel page-fault oops documented in the companion fix 654b33ada4ab; the crash can be retriggered on every module unload."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:41.738Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34"
        },
        {
          "url": "https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05"
        }
      ],
      "title": "proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38653",
    "datePublished": "2025-08-22T16:00:57.413Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-10-15T22:02:27.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68183 (GCVE-0-2025-68183)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:43 – Updated: 2026-10-30 12:23

Title

ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Summary

In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h> int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd; fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); } if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } close(fd); return 0; }

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:59 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/7d9ae9d4d45b28c18…
https://git.kernel.org/stable/c/d2993a7e98eb70c73…
https://git.kernel.org/stable/c/edd824eb45e4f7e05…
https://git.kernel.org/stable/c/02aa671c08a4834be…
https://git.kernel.org/stable/c/88b4cbcf6b041ae0f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e3ccfe1ad7d895487977ef64eda3441d16c9851a , < 7d9ae9d4d45b28c18ca06ae047aabe09d9639643 (git) Affected: e3ccfe1ad7d895487977ef64eda3441d16c9851a , < d2993a7e98eb70c737c6f5365a190e79c72b8407 (git) Affected: e3ccfe1ad7d895487977ef64eda3441d16c9851a , < edd824eb45e4f7e05ad3ab090dab6dbdb79cd292 (git) Affected: e3ccfe1ad7d895487977ef64eda3441d16c9851a , < 02aa671c08a4834bef5166743a7b88686fbfa023 (git) Affected: e3ccfe1ad7d895487977ef64eda3441d16c9851a , < 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd (git)
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.117 , ≤ 6.6.* (semver) Unaffected: 6.12.58 , ≤ 6.12.* (semver) Unaffected: 6.17.8 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:57.175994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:47.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_appraise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d9ae9d4d45b28c18ca06ae047aabe09d9639643",
              "status": "affected",
              "version": "e3ccfe1ad7d895487977ef64eda3441d16c9851a",
              "versionType": "git"
            },
            {
              "lessThan": "d2993a7e98eb70c737c6f5365a190e79c72b8407",
              "status": "affected",
              "version": "e3ccfe1ad7d895487977ef64eda3441d16c9851a",
              "versionType": "git"
            },
            {
              "lessThan": "edd824eb45e4f7e05ad3ab090dab6dbdb79cd292",
              "status": "affected",
              "version": "e3ccfe1ad7d895487977ef64eda3441d16c9851a",
              "versionType": "git"
            },
            {
              "lessThan": "02aa671c08a4834bef5166743a7b88686fbfa023",
              "status": "affected",
              "version": "e3ccfe1ad7d895487977ef64eda3441d16c9851a",
              "versionType": "git"
            },
            {
              "lessThan": "88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd",
              "status": "affected",
              "version": "e3ccfe1ad7d895487977ef64eda3441d16c9851a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_appraise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: don\u0027t clear IMA_DIGSIG flag when setting or removing non-IMA xattr\n\nCurrently when both IMA and EVM are in fix mode, the IMA signature will\nbe reset to IMA hash if a program first stores IMA signature in\nsecurity.ima and then writes/removes some other security xattr for the\nfile.\n\nFor example, on Fedora, after booting the kernel with \"ima_appraise=fix\nevm=fix ima_policy=appraise_tcb\" and installing rpm-plugin-ima,\ninstalling/reinstalling a package will not make good reference IMA\nsignature generated. Instead IMA hash is generated,\n\n    # getfattr -m - -d -e hex /usr/bin/bash\n    # file: usr/bin/bash\n    security.ima=0x0404...\n\nThis happens because when setting security.selinux, the IMA_DIGSIG flag\nthat had been set early was cleared. As a result, IMA hash is generated\nwhen the file is closed.\n\nSimilarly, IMA signature can be cleared on file close after removing\nsecurity xattr like security.evm or setting/removing ACL.\n\nPrevent replacing the IMA file signature with a file hash, by preventing\nthe IMA_DIGSIG flag from being reset.\n\nHere\u0027s a minimal C reproducer which sets security.selinux as the last\nstep which can also replaced by removing security.evm or setting ACL,\n\n    #include \u003cstdio.h\u003e\n    #include \u003csys/xattr.h\u003e\n    #include \u003cfcntl.h\u003e\n    #include \u003cunistd.h\u003e\n    #include \u003cstring.h\u003e\n    #include \u003cstdlib.h\u003e\n\n    int main() {\n        const char* file_path = \"/usr/sbin/test_binary\";\n        const char* hex_string = \"030204d33204490066306402304\";\n        int length = strlen(hex_string);\n        char* ima_attr_value;\n        int fd;\n\n        fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);\n        if (fd == -1) {\n            perror(\"Error opening file\");\n            return 1;\n        }\n\n        ima_attr_value = (char*)malloc(length / 2 );\n        for (int i = 0, j = 0; i \u003c length; i += 2, j++) {\n            sscanf(hex_string + i, \"%2hhx\", \u0026ima_attr_value[j]);\n        }\n\n        if (fsetxattr(fd, \"security.ima\", ima_attr_value, length/2, 0) == -1) {\n            perror(\"Error setting extended attribute\");\n            close(fd);\n            return 1;\n        }\n\n        const char* selinux_value= \"system_u:object_r:bin_t:s0\";\n        if (fsetxattr(fd, \"security.selinux\", selinux_value, strlen(selinux_value), 0) == -1) {\n            perror(\"Error setting extended attribute\");\n            close(fd);\n            return 1;\n        }\n\n        close(fd);\n\n        return 0;\n    }"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires local syscalls against a file on the system \u2014 `setxattr`/`fsetxattr` on an EVM-protected xattr, `setfacl`, or `fremovexattr` \u2014 followed by an open/close of the target file. No network, adjacent-network, or physical path reaches the IMA appraisal hooks.\nAC:L - The commit ships a deterministic reproducer: setting any EVM-protected xattr or a POSIX ACL unconditionally clears IMA_DIGSIG every time, with no memory-layout or timing luck involved. The enforce-mode variant needs a race against `process_measurement()`\u0027s `MAY_WRITE` check, but `ima_reset_appraise_flags()` takes no `iint-\u003emutex`, and the attacker drives both sides (one thread spinning on `setxattr(\"system.posix_acl_access\")`, another on `open(O_WRONLY)`); the required IMA-appraise + EVM configuration is a shipped, supported Fedora/RHEL setup, not a rare build option.\nPR:L - `vfs_set_acl()` invokes `security_inode_set_acl()` \u2192 `ima_inode_set_acl()` \u2192 `ima_reset_appraise_flags(inode, 0)` before `set_posix_acl()` ever reaches its `inode_owner_or_capable()` check, so an unprivileged user with no capabilities and no ownership of the file clears the cached IMA_DIGSIG bit on any signed appraised binary \u2014 the syscall fails with -EPERM only after the flag is already gone. No CAP_SYS_ADMIN is needed for this path, unlike the `security.ima` path guarded by `ima_protect_xattr()`.\nUI:N - The attacker performs the xattr/ACL operation and the file open/close entirely from their own process; no victim must mount a filesystem, open a file, or take any other action for the IMA_DIGSIG flag to be cleared and the signature to be replaced.\nS:U - The defeated control (IMA appraisal) and the affected resources (files and their security xattrs) live in the same kernel security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Clearing IMA_DIGSIG both drops the \"signed files cannot be opened for write\" enforcement at `ima_main.c:472` and lets `ima_update_xattr()` re-bless the modified content with a fresh hash plus EVM HMAC, so attacker-substituted content in an appraised executable passes appraisal and subsequently runs \u2014 typically in a privileged/service context \u2014 yielding full disclosure of data reachable by that code. This is the standard treatment of a code-integrity/signature-verification bypass; the bug itself contains no direct memory-read primitive.\nI:H - The file\u0027s IMA digital signature \u2014 the one integrity artifact a local attacker cannot forge, since it is verified against the trusted IMA keyring \u2014 is silently destroyed and replaced by a locally computed hash written through `__vfs_setxattr_noperm()`, which bypasses the `CAP_SYS_ADMIN` gate in `ima_protect_xattr()`. Combined with the lost write-block, this converts \"signed and immutable\" into \"mutable and re-blessed on close\", a complete integrity bypass of IMA appraisal for the affected file.\nA:H - Once a signature is replaced by a plain hash, any policy carrying IMA_DIGSIG_REQUIRED (`appraise_type=imasig`) rejects that file in enforce mode, so appraised binaries become permanently unexecutable \u2014 applied to system-critical files such as init, sshd, or libc consumers this denies service and can leave the system unbootable, and the corrupted xattr persists on disk until the file is re-signed out of band."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:23:06.322Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d9ae9d4d45b28c18ca06ae047aabe09d9639643"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2993a7e98eb70c737c6f5365a190e79c72b8407"
        },
        {
          "url": "https://git.kernel.org/stable/c/edd824eb45e4f7e05ad3ab090dab6dbdb79cd292"
        },
        {
          "url": "https://git.kernel.org/stable/c/02aa671c08a4834bef5166743a7b88686fbfa023"
        },
        {
          "url": "https://git.kernel.org/stable/c/88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd"
        }
      ],
      "title": "ima: don\u0027t clear IMA_DIGSIG flag when setting or removing non-IMA xattr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68183",
    "datePublished": "2025-12-16T13:43:01.178Z",
    "dateReserved": "2025-12-16T13:41:40.252Z",
    "dateUpdated": "2026-10-30T12:23:06.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68724 (GCVE-0-2025-68724)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:33 – Updated: 2026-11-10 12:38

Title

crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 19:22 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/60a7be5ee74408147…
https://git.kernel.org/stable/c/c13c6e9de91d7f1dd…
https://git.kernel.org/stable/c/dfc16139618287451…
https://git.kernel.org/stable/c/5b8ac617c8dab5cad…
https://git.kernel.org/stable/c/c73be4f51eed98fa0…
https://git.kernel.org/stable/c/6af753ac5205115e6…
https://git.kernel.org/stable/c/b7090a5c153105b9f…
https://git.kernel.org/stable/c/df0845cf447ae1556…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

12 products

Vendor	Product	Version
Linux	Linux	Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < 60a7be5ee74408147e439164ac067e418ca74bb4 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < c13c6e9de91d7f1dd7df756b1fa5a1f968839d76 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < dfc1613961828745165aec6552c3818fa14ab725 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < 5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < c73be4f51eed98fa0c7c189db8f279e1c86bfbf7 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < 6af753ac5205115e6c310c8c4236c01b59a1c44f (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < b7090a5c153105b9fd221a5a81459ee8cd5babd6 (git) Affected: 7901c1a8effbe5f89673bfc09d6e37b8f334f1a7 , < df0845cf447ae1556c3440b8b155de0926cbaa56 (git)
Linux	Linux	Affected: 3.18 Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.63 , ≤ 6.12.* (semver) Unaffected: 6.17.13 , ≤ 6.17.* (semver) Unaffected: 6.18.2 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.7 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:22:49.497362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:22:59.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T12:38:16.189Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/asymmetric_keys/asymmetric_type.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60a7be5ee74408147e439164ac067e418ca74bb4",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "c13c6e9de91d7f1dd7df756b1fa5a1f968839d76",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "dfc1613961828745165aec6552c3818fa14ab725",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "c73be4f51eed98fa0c7c189db8f279e1c86bfbf7",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "6af753ac5205115e6c310c8c4236c01b59a1c44f",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "b7090a5c153105b9fd221a5a81459ee8cd5babd6",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            },
            {
              "lessThan": "df0845cf447ae1556c3440b8b155de0926cbaa56",
              "status": "affected",
              "version": "7901c1a8effbe5f89673bfc09d6e37b8f334f1a7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/asymmetric_keys/asymmetric_type.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id\n\nUse check_add_overflow() to guard against potential integer overflows\nwhen adding the binary blob lengths and the size of an asymmetric_key_id\nstructure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a\npossible buffer overflow when copying data from potentially malicious\nX.509 certificate fields that can be arbitrarily large, such as ASN.1\nINTEGER serial numbers, issuer names, etc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable X.509 parsing path is reached through the local add_key syscall and related local PKCS#7 consumers, not directly through network packet processing.\nAC:L - The overflow is deterministic from attacker-controlled certificate field lengths and requires no race, victim-controlled state, or unpredictable condition.\nPR:L - An ordinary unprivileged user can submit an asymmetric key to a writable process or session keyring without capabilities. Parsing occurs before certificate trust and keyring restriction checks.\nUI:N - The attacker directly invokes the keyring interface with the crafted certificate, requiring no action by another user.\nS:U - Exploitation compromises the kernel within the same host security authority and does not inherently cross a VM, IOMMU, or other distinct security boundary.\nC:H - The undersized allocation followed by oversized memcpy operations can corrupt kernel heap objects and potentially enable kernel code execution with arbitrary memory disclosure.\nI:H - The heap out-of-bounds writes can overwrite adjacent objects, function pointers, or credentials, potentially enabling arbitrary kernel writes and control-flow hijacking.\nA:H - The overflow can immediately produce an oops or kernel panic and can be triggered repeatedly by an unprivileged local attacker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:08.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60a7be5ee74408147e439164ac067e418ca74bb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c13c6e9de91d7f1dd7df756b1fa5a1f968839d76"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfc1613961828745165aec6552c3818fa14ab725"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c73be4f51eed98fa0c7c189db8f279e1c86bfbf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6af753ac5205115e6c310c8c4236c01b59a1c44f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7090a5c153105b9fd221a5a81459ee8cd5babd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/df0845cf447ae1556c3440b8b155de0926cbaa56"
        }
      ],
      "title": "crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68724",
    "datePublished": "2025-12-24T10:33:08.932Z",
    "dateReserved": "2025-12-24T10:30:51.027Z",
    "dateUpdated": "2026-11-10T12:38:16.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31408 (GCVE-0-2026-31408)

Vulnerability from cvelistv5 – Published: 2026-04-06 07:38 – Updated: 2026-10-19 18:35

Title

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:09 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/37e18bc8c9a70d77b…
https://git.kernel.org/stable/c/d57384e27d1ebf004…
https://git.kernel.org/stable/c/b0a7da0e3f7442545…
https://git.kernel.org/stable/c/45aaca995e4a7a05b…
https://git.kernel.org/stable/c/108b81514d8f2535e…
https://git.kernel.org/stable/c/7197462e90b8ce15c…
https://git.kernel.org/stable/c/e76e8f0581ef555ea…
https://git.kernel.org/stable/c/598dbba9919c5e36c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d57384e27d1ebf0047e3f00a6e1181b8be9857a2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b0a7da0e3f7442545f071499beb36374714bb9de (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 108b81514d8f2535eb16651495cefb2250528db3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e76e8f0581ef555eacc11dbb095e602fb30a5361 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 598dbba9919c5e36c54fe1709b557d64120cb94b (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:09:03.338755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:35:47.242Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d57384e27d1ebf0047e3f00a6e1181b8be9857a2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b0a7da0e3f7442545f071499beb36374714bb9de",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "45aaca995e4a7a05b272a58e7ab2fff4f611b8f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "108b81514d8f2535eb16651495cefb2250528db3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e76e8f0581ef555eacc11dbb095e602fb30a5361",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "598dbba9919c5e36c54fe1709b557d64120cb94b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold\n\nsco_recv_frame() reads conn-\u003esk under sco_conn_lock() but immediately\nreleases the lock without holding a reference to the socket. A concurrent\nclose() can free the socket between the lock release and the subsequent\nsk-\u003esk_state access, resulting in a use-after-free.\n\nOther functions in the same file (sco_sock_timeout(), sco_conn_del())\ncorrectly use sco_sock_hold() to safely hold a reference under the lock.\n\nFix by using sco_sock_hold() to take a reference before releasing the\nlock, and adding sock_put() on all exit paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Incoming Bluetooth SCO/eSCO data reaches the vulnerable function through the HCI receive path, so the attacker must be within Bluetooth radio range. This is adjacent-network reachability, not IP network or physical-device access.\nAC:L - The bug is a use-after-free race between received SCO data and socket close/teardown, and an attacker can repeatedly drive SCO traffic while provoking endpoint teardown to hit the window. No rare configuration or uncontrollable memory layout condition is required beyond Bluetooth SCO support.\nPR:N - The Bluetooth peer sending SCO data needs no account or privileges on the target system, and the per-packet receive path has no capability or authentication check. Incoming acceptance depends on Bluetooth connection/listening state, not target-user privileges held by the attacker.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an explicit action. Once the Bluetooth/SCO endpoint is active, packets and teardown can be driven by protocol activity.\nS:U - The vulnerability is in the kernel Bluetooth stack and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a kernel use-after-free of a socket object, and subsequent code dereferences the freed sock and can pass it into receive-queue handling. Such heap UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is high.\nI:H - The freed sock pointer can be used in `sock_queue_rcv_skb()`, which updates socket queues/state and can invoke socket callbacks after reuse. This is kernel memory corruption with plausible control-flow or arbitrary-write exploitation, so integrity impact is high.\nA:H - Even without full exploitation, dereferencing and operating on a freed kernel socket can cause an oops, panic, or memory corruption crash. Availability impact is therefore high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:27:56.705Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0a7da0e3f7442545f071499beb36374714bb9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/108b81514d8f2535eb16651495cefb2250528db3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e76e8f0581ef555eacc11dbb095e602fb30a5361"
        },
        {
          "url": "https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b"
        }
      ],
      "title": "Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31408",
    "datePublished": "2026-04-06T07:38:20.533Z",
    "dateReserved": "2026-03-09T15:48:24.086Z",
    "dateUpdated": "2026-10-19T18:35:47.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43027 (GCVE-0-2026-43027)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-11-10 12:46

Title

netfilter: nf_conntrack_helper: pass helper to expect cleanup

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregistered. However, it passes NULL instead of the helper pointer as the data argument, so expect_iter_me() never matches any expectation and all of them survive the cleanup. After unregister returns, nfnl_cthelper_del() frees the helper object immediately. Subsequent expectation dumps or packet-driven init_conntrack() calls then dereference the freed exp->helper, causing a use-after-free. Pass the actual helper pointer so expectations referencing it are properly destroyed before the helper object is freed. BUG: KASAN: slab-use-after-free in string+0x38f/0x430 Read of size 1 at addr ffff888003b14d20 by task poc/103 Call Trace: string+0x38f/0x430 vsnprintf+0x3cc/0x1170 seq_printf+0x17a/0x240 exp_seq_show+0x2e5/0x560 seq_read_iter+0x419/0x1280 proc_reg_read+0x1ac/0x270 vfs_read+0x179/0x930 ksys_read+0xef/0x1c0 Freed by task 103: The buggy address is located 32 bytes inside of freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 15:26 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af…
https://git.kernel.org/stable/c/504ba4168466c9121…
https://git.kernel.org/stable/c/dc1739eff48e34cc7…
https://git.kernel.org/stable/c/2cf2737c85a2ba2b5…
https://git.kernel.org/stable/c/2c16e4d64dd912277…
https://git.kernel.org/stable/c/620f3d14c1ef51d42…
https://git.kernel.org/stable/c/90bd7e8501349db30…
https://git.kernel.org/stable/c/a242a9ae58aa46ff7…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

17 products

Vendor	Product	Version
Linux	Linux	Affected: ac7b848390036dadd4351899d2a23748075916bd , < 5cf28d5c8dcbbe8af6d3b145babe491906d7bad1 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 504ba4168466c91210c45acdc332479cfd5f2da6 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < dc1739eff48e34cc71d4e2f03715493fbcebd8af (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 2cf2737c85a2ba2b52024dafe68ffad2676f97be (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 2c16e4d64dd91227742dfe196a3e7b0568bef65a (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 620f3d14c1ef51d425060a3056ad8dbae8f998a3 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 90bd7e8501349db3006d21fbc09df9ffcb172965 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < a242a9ae58aa46ff7dae51ce64150a93957abe65 (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)	Affected: V3.1.7 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)	Affected: V3.1.7 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T12:46:08.747Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T15:26:36.815573Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T15:32:27.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5cf28d5c8dcbbe8af6d3b145babe491906d7bad1",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "504ba4168466c91210c45acdc332479cfd5f2da6",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "dc1739eff48e34cc71d4e2f03715493fbcebd8af",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "2cf2737c85a2ba2b52024dafe68ffad2676f97be",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "2c16e4d64dd91227742dfe196a3e7b0568bef65a",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "620f3d14c1ef51d425060a3056ad8dbae8f998a3",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "90bd7e8501349db3006d21fbc09df9ffcb172965",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "a242a9ae58aa46ff7dae51ce64150a93957abe65",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately.  Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp-\u003ehelper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n  BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n  Read of size 1 at addr ffff888003b14d20 by task poc/103\n  Call Trace:\n   string+0x38f/0x430\n   vsnprintf+0x3cc/0x1170\n   seq_printf+0x17a/0x240\n   exp_seq_show+0x2e5/0x560\n   seq_read_iter+0x419/0x1280\n   proc_reg_read+0x1ac/0x270\n   vfs_read+0x179/0x930\n   ksys_read+0xef/0x1c0\n  Freed by task 103:\n  The buggy address is located 32 bytes inside of\n   freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:16:18.081Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a"
        },
        {
          "url": "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965"
        },
        {
          "url": "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65"
        }
      ],
      "title": "netfilter: nf_conntrack_helper: pass helper to expect cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43027",
    "datePublished": "2026-05-01T14:15:28.521Z",
    "dateReserved": "2026-05-01T14:12:55.976Z",
    "dateUpdated": "2026-11-10T12:46:08.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43074 (GCVE-0-2026-43074)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:21 – Updated: 2026-10-19 19:06

Title

eventpoll: defer struct eventpoll free to RCU grace period

Summary

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:14 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/902120be4f44947df…
https://git.kernel.org/stable/c/a6d57084372161f86…
https://git.kernel.org/stable/c/a6566cd33f6f967a7…
https://git.kernel.org/stable/c/5b1173b165421561d…
https://git.kernel.org/stable/c/7e8083f5eeedab0f4…
https://git.kernel.org/stable/c/ae0bb9c1fb7c25945…
https://git.kernel.org/stable/c/07712db80857d5d09…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: f2451def095c1743adcfcb0cb5dadc86034e162a , < 902120be4f44947df6311002addc7faf69bdbff1 (git) Affected: a1f93804449d13f97dabd4b996817de4bf1ed67a , < a6d57084372161f86660bc4607784420e00efe2c (git) Affected: 58c9b016e12855286370dfb704c08498edbc857a , < a6566cd33f6f967a7651ebf2ce0dd31572e319cf (git) Affected: 58c9b016e12855286370dfb704c08498edbc857a , < 5b1173b165421561db29f30afc7e97d940a398a9 (git) Affected: 58c9b016e12855286370dfb704c08498edbc857a , < 7e8083f5eeedab0f460063b9c2c14c9a4e71a427 (git) Affected: 58c9b016e12855286370dfb704c08498edbc857a , < ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322 (git) Affected: 58c9b016e12855286370dfb704c08498edbc857a , < 07712db80857d5d09ae08f3df85a708ecfc3b61f (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:18:59.733Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:21.825973Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:06:12.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/eventpoll.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "902120be4f44947df6311002addc7faf69bdbff1",
              "status": "affected",
              "version": "f2451def095c1743adcfcb0cb5dadc86034e162a",
              "versionType": "git"
            },
            {
              "lessThan": "a6d57084372161f86660bc4607784420e00efe2c",
              "status": "affected",
              "version": "a1f93804449d13f97dabd4b996817de4bf1ed67a",
              "versionType": "git"
            },
            {
              "lessThan": "a6566cd33f6f967a7651ebf2ce0dd31572e319cf",
              "status": "affected",
              "version": "58c9b016e12855286370dfb704c08498edbc857a",
              "versionType": "git"
            },
            {
              "lessThan": "5b1173b165421561db29f30afc7e97d940a398a9",
              "status": "affected",
              "version": "58c9b016e12855286370dfb704c08498edbc857a",
              "versionType": "git"
            },
            {
              "lessThan": "7e8083f5eeedab0f460063b9c2c14c9a4e71a427",
              "status": "affected",
              "version": "58c9b016e12855286370dfb704c08498edbc857a",
              "versionType": "git"
            },
            {
              "lessThan": "ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322",
              "status": "affected",
              "version": "58c9b016e12855286370dfb704c08498edbc857a",
              "versionType": "git"
            },
            {
              "lessThan": "07712db80857d5d09ae08f3df85a708ecfc3b61f",
              "status": "affected",
              "version": "58c9b016e12855286370dfb704c08498edbc857a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/eventpoll.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: defer struct eventpoll free to RCU grace period\n\nIn certain situations, ep_free() in eventpoll.c will kfree the epi-\u003eep\neventpoll struct while it still being used by another concurrent thread.\nDefer the kfree() to an RCU callback to prevent UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local epoll syscalls, primarily `epoll_ctl(EPOLL_CTL_ADD)` on nested epoll descriptors racing with descriptor close/release. Network input is not sufficient to reach the lifetime bug without local control of epoll file descriptors.\nAC:L - The race is attacker-controlled: an unprivileged local process can create the epoll graph and run concurrent threads performing nested `epoll_ctl()` and close/release operations. No rare external state or victim timing is required beyond winning a race the attacker can repeatedly drive.\nPR:L - Creating epoll descriptors and calling `epoll_ctl()` require only ordinary local user privileges. No capability check gates the vulnerable nested epoll path; the only capability-related logic masks `EPOLLWAKEUP` and is not relevant.\nUI:N - Exploitation does not require another user to open files, mount anything, or perform any action. The attacking process can create, nest, and close all relevant descriptors itself.\nS:U - The impact is within the kernel security authority as a local kernel memory corruption or privilege escalation. There is no VM escape, IOMMU bypass, or cross-authority boundary change shown by this bug.\nC:H - This is a use-after-free of `struct eventpoll` during an RCU walk, and the stale pointer can be dereferenced after the object is freed and potentially reallocated. Per kernel CVSS guidance, a UAF is treated as enabling high confidentiality impact through exploitable memory corruption.\nI:H - The stale `struct eventpoll` is not only read but also written via fields such as `gen` and `loop_check_depth` after free, making heap corruption plausible if the memory is reallocated. Per kernel CVSS guidance, UAF memory corruption supports high integrity impact.\nA:H - At minimum, dereferencing or writing a freed `struct eventpoll` can crash or corrupt the kernel. A local attacker can repeatedly trigger the race, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:45.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/902120be4f44947df6311002addc7faf69bdbff1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d57084372161f86660bc4607784420e00efe2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6566cd33f6f967a7651ebf2ce0dd31572e319cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b1173b165421561db29f30afc7e97d940a398a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e8083f5eeedab0f460063b9c2c14c9a4e71a427"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322"
        },
        {
          "url": "https://git.kernel.org/stable/c/07712db80857d5d09ae08f3df85a708ecfc3b61f"
        }
      ],
      "title": "eventpoll: defer struct eventpoll free to RCU grace period",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43074",
    "datePublished": "2026-05-06T07:21:58.210Z",
    "dateReserved": "2026-05-01T14:12:55.982Z",
    "dateUpdated": "2026-10-19T19:06:12.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43330 (GCVE-0-2026-43330)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:31 – Updated: 2026-08-05 12:27

Title

crypto: caam - fix overflow on long hmac keys

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory. The copying is performed using kmemdup, however this leads to an overflow: reading more bytes (aligned_len - keylen) from the keylen source buffer. Fix this by replacing kmemdup with kmalloc, followed by memcpy.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/31022cfde5235c45f…
https://git.kernel.org/stable/c/c2fb4984fe09fc176…
https://git.kernel.org/stable/c/aa545df011338df13…
https://git.kernel.org/stable/c/cebc5ebd958346195…
https://git.kernel.org/stable/c/80688afb9c35b3934…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < 31022cfde5235c45fa765f0aabeff5f0652852f2 (git) Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < c2fb4984fe09fc176fe4c12d5e3edf626df6511d (git) Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < aa545df011338df13f0833fc1fabcb15c0521959 (git) Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < cebc5ebd958346195b77f42d0cd5141b4e448fae (git) Affected: 199354d7fb6eaa2cc5bb650af0bca624baffee35 , < 80688afb9c35b3934ce2d6be9973758915e2e0ef (git)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamalg_qi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31022cfde5235c45fa765f0aabeff5f0652852f2",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "c2fb4984fe09fc176fe4c12d5e3edf626df6511d",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "aa545df011338df13f0833fc1fabcb15c0521959",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "cebc5ebd958346195b77f42d0cd5141b4e448fae",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            },
            {
              "lessThan": "80688afb9c35b3934ce2d6be9973758915e2e0ef",
              "status": "affected",
              "version": "199354d7fb6eaa2cc5bb650af0bca624baffee35",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamalg_qi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - fix overflow on long hmac keys\n\nWhen a key longer than block size is supplied, it is copied and then\nhashed into the real key.  The memory allocated for the copy needs to\nbe rounded to DMA cache alignment, as otherwise the hashed key may\ncorrupt neighbouring memory.\n\nThe copying is performed using kmemdup, however this leads to an overflow:\nreading more bytes (aligned_len - keylen) from the keylen source buffer.\nFix this by replacing kmemdup with kmalloc, followed by memcpy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches the vulnerable CAAM HMAC `ahash_setkey` path locally through the unprivileged `AF_ALG` hash socket interface and `setsockopt(ALG_SET_KEY)`. There is no remotely supplied packet or adjacent-link protocol path that directly chooses this HMAC key.\nAC:L - The attacker directly controls the algorithm selection and long key length, and triggering only requires supplying a key longer than the hash block size on a system with the CAAM QI2 driver registered. No race or victim-controlled timing condition is required.\nPR:L - Creating and using `AF_ALG` hash sockets does not require administrative capabilities, so any local unprivileged user can invoke the setkey path. It is therefore Low privileges, not High.\nUI:N - No victim action is needed after the attacker has local code execution; the attacker can open the socket, bind the HMAC algorithm, and set the key themselves.\nS:U - The vulnerability is in kernel crypto driver handling and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate authorization boundary.\nC:H - The bug is an out-of-bounds kernel heap read from the temporary key buffer by up to DMA cache-alignment padding, and repeated attacker-controlled invocations can expose sensitive adjacent kernel memory. Under the conservative rule, this kernel OOB read is scored as High confidentiality impact.\nI:H - The affected long-key path is kernel DMA/HMAC key handling where incorrect aligned-buffer handling is associated with neighboring memory corruption, and exploitation of kernel memory-safety bugs can plausibly yield arbitrary modification or code execution. Under the required higher-severity tie-break, integrity is High.\nA:H - The overflow can trigger kernel memory safety failures such as KASAN reports, faults, oopses, or DMA-related corruption in kernel memory. This is sufficient for High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:16.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31022cfde5235c45fa765f0aabeff5f0652852f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2fb4984fe09fc176fe4c12d5e3edf626df6511d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa545df011338df13f0833fc1fabcb15c0521959"
        },
        {
          "url": "https://git.kernel.org/stable/c/cebc5ebd958346195b77f42d0cd5141b4e448fae"
        },
        {
          "url": "https://git.kernel.org/stable/c/80688afb9c35b3934ce2d6be9973758915e2e0ef"
        }
      ],
      "title": "crypto: caam - fix overflow on long hmac keys",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43330",
    "datePublished": "2026-05-08T13:31:18.133Z",
    "dateReserved": "2026-05-01T14:12:56.002Z",
    "dateUpdated": "2026-08-05T12:27:16.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43414 (GCVE-0-2026-43414)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-10-30 12:25

Title

scsi: qla2xxx: Completely fix fcport double free

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:17 UTC

CWE

CWE-415 - Double Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/bb9c7eca6f8f2e4a1…
https://git.kernel.org/stable/c/baabbd29191514391…
https://git.kernel.org/stable/c/7172f41786dc08144…
https://git.kernel.org/stable/c/4097a2afe8acc6038…
https://git.kernel.org/stable/c/d48ea85463f5b34f7…
https://git.kernel.org/stable/c/c0b7da13a04bd70ef…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3b9d72442adfbc9ddb0f76dd1b03977b3a578b16 , < bb9c7eca6f8f2e4a1cd8ba6711e7efe9044c0327 (git) Affected: ef23850940d9a52c39936d27254824ccf5e9b6bd , < baabbd29191514391ca81594e43261bd17c6795a (git) Affected: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 , < 7172f41786dc08144da4627483e405de57bf8d2c (git) Affected: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 , < 4097a2afe8acc6038b71aab825430f1403decf20 (git) Affected: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 , < d48ea85463f5b34f7b92ea0a13eddf1ab993da7b (git) Affected: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 , < c0b7da13a04bd70ef6070bfb9ea85f582294560a (git) Affected: 7861213201838480dc222634c56fb6db113d010d (git) Affected: 6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63 (git) Affected: cd10dee1f07a782f5aa05703c55299ca86a85ee4 (git) Affected: b03e626bd6d3f0684f56ee1890d70fc9ca991c04 (git) Affected: 282877633b25d67021a34169c5b5519b1d4ef65e (git) Affected: f85af9f1aa5e2f53694a6cbe72010f754b5ff862 (git) Affected: 9b43d2884b54d415caab48878b526dfe2ae9921b (git) Affected: 846fb9f112f618ec6ae181d8dae7961652574774 (git) Affected: 6.1.84 , < 6.1.191 (semver) Affected: 6.6.24 , < 6.6.160 (semver) Affected: 5.15.154 , < 5.16 (semver) Affected: 6.7.12 , < 6.8 (semver) Affected: 6.8.3 , < 6.9 (semver)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 6.19.9 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:17:19.251803Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-415",
                "description": "CWE-415 Double Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:26:36.522Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_iocb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb9c7eca6f8f2e4a1cd8ba6711e7efe9044c0327",
              "status": "affected",
              "version": "3b9d72442adfbc9ddb0f76dd1b03977b3a578b16",
              "versionType": "git"
            },
            {
              "lessThan": "baabbd29191514391ca81594e43261bd17c6795a",
              "status": "affected",
              "version": "ef23850940d9a52c39936d27254824ccf5e9b6bd",
              "versionType": "git"
            },
            {
              "lessThan": "7172f41786dc08144da4627483e405de57bf8d2c",
              "status": "affected",
              "version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
              "versionType": "git"
            },
            {
              "lessThan": "4097a2afe8acc6038b71aab825430f1403decf20",
              "status": "affected",
              "version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
              "versionType": "git"
            },
            {
              "lessThan": "d48ea85463f5b34f7b92ea0a13eddf1ab993da7b",
              "status": "affected",
              "version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
              "versionType": "git"
            },
            {
              "lessThan": "c0b7da13a04bd70ef6070bfb9ea85f582294560a",
              "status": "affected",
              "version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7861213201838480dc222634c56fb6db113d010d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cd10dee1f07a782f5aa05703c55299ca86a85ee4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b03e626bd6d3f0684f56ee1890d70fc9ca991c04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "282877633b25d67021a34169c5b5519b1d4ef65e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f85af9f1aa5e2f53694a6cbe72010f754b5ff862",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b43d2884b54d415caab48878b526dfe2ae9921b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "846fb9f112f618ec6ae181d8dae7961652574774",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.191",
              "status": "affected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.160",
              "status": "affected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_iocb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "6.1.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Completely fix fcport double free\n\nIn qla24xx_els_dcmd_iocb() sp-\u003efree is set to qla2x00_els_dcmd_sp_free().\nWhen an error happens, this function is called by qla2x00_sp_release(),\nwhen kref_put() releases the first and the last reference.\n\nqla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().\nDoing it one more time after kref_put() is a bad idea."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable ELS direct-command path is reachable from a remote Fibre Channel initiator through qla2xxx target-mode ELS/session-deletion handling, not only through the root-only sysfs issue_logo knob. Using the highest reasonable SAN deployment, attacker-controlled FC frames from another host on the storage fabric make this network-reachable.\nAC:L - The bug is a deterministic double free once the ELS direct-command error path is hit after kref_put(), and the attacker can plausibly drive repeated logins/logouts/session teardown plus resource pressure to make qla2x00_start_sp() fail. No uncontrollable race is required for the memory corruption once that path is reached.\nPR:N - The FC target path processes remote ELS events before any Linux credential or capability check on the victim, so the attacker does not need a local account or kernel privilege. Fabric access/zoning is environmental network access, not privileges on the vulnerable system.\nUI:N - No victim user action is required; remote FC protocol activity can drive the target-mode session deletion and LOGO path. The sysfs path requires an admin write, but it is not the highest-severity reachable path.\nS:U - The corruption occurs inside the same kernel/driver security authority and does not cross a VM, IOMMU, or other separate security boundary. A kernel compromise or crash remains unchanged scope.\nC:H - This is kernel heap double-free/use-after-free style memory corruption of an fc_port object. Under the required overestimation rule, such corruption can be leveraged for information disclosure through heap reuse/read primitives.\nI:H - A double free of a kernel heap object can corrupt allocator state or enable controlled reuse of freed memory, making arbitrary write or control-flow compromise defensible. Therefore integrity impact is High.\nA:H - Related qla2xxx fcport double-free reports show immediate SLUB/kernel BUG crashes, and this fix removes another remaining double-free error path. A remotely triggerable kernel crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:25:31.583Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb9c7eca6f8f2e4a1cd8ba6711e7efe9044c0327"
        },
        {
          "url": "https://git.kernel.org/stable/c/baabbd29191514391ca81594e43261bd17c6795a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7172f41786dc08144da4627483e405de57bf8d2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4097a2afe8acc6038b71aab825430f1403decf20"
        },
        {
          "url": "https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a"
        }
      ],
      "title": "scsi: qla2xxx: Completely fix fcport double free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43414",
    "datePublished": "2026-05-08T14:21:51.604Z",
    "dateReserved": "2026-05-01T14:12:56.008Z",
    "dateUpdated": "2026-10-30T12:25:31.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46113 (GCVE-0-2026-46113)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-10-19 19:26

Title

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous). - the PDE mapping is changed from outside the guest. - the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped. - the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3. - any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED). The underlying issue is that KVM's walking of shadow PTEs assumes that if a SPTE is present when KVM wants to install a non-leaf SPTE, then the existing kvm_mmu_page must be for the correct gfn. Because the only way for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... which shouldn't happen, but *actually* only happens in response to a guest write. That bug dates back literally forever, as even the first version of KVM assumes that the GFN matches and walks into the "wrong" shadow page. However, that was only an imprecision until 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") came along. Fix it by checking for a target gfn mismatch and zapping the existing SPTE. That way the old SP and rmap entries are gone, KVM installs the rmap in the right location, and everyone is happy.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:19 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9597963a8ca16259d…
https://git.kernel.org/stable/c/e9d4ea13aa2b6400b…
https://git.kernel.org/stable/c/488e386484ec8c0e5…
https://git.kernel.org/stable/c/06c19c967b845b631…
https://git.kernel.org/stable/c/738ec97b1855df6c0…
https://git.kernel.org/stable/c/14d1e55dfd2cf4711…
https://git.kernel.org/stable/c/0cb2af2ea66ad8ff1…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < 9597963a8ca16259d194a1d9950d7bd22a10ab2f (git) Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < e9d4ea13aa2b6400bb10ec64b370ba3dadcd22f0 (git) Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < 488e386484ec8c0e558be6e156edf34ed9f4d5c8 (git) Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < 06c19c967b845b63172601fe459667d973b7e6b7 (git) Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < 738ec97b1855df6c08fe2369f798fa0b972e556b (git) Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < 14d1e55dfd2cf4711bff164a6aaaddb783552134 (git) Affected: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 , < 0cb2af2ea66ad8ff195c156ea690f11216285bdf (git)
Linux	Linux	Affected: 2.6.20 Unaffected: 0 , < 2.6.20 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:20:35.003Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:19:45.859135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:26:44.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9597963a8ca16259d194a1d9950d7bd22a10ab2f",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            },
            {
              "lessThan": "e9d4ea13aa2b6400bb10ec64b370ba3dadcd22f0",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            },
            {
              "lessThan": "488e386484ec8c0e558be6e156edf34ed9f4d5c8",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            },
            {
              "lessThan": "06c19c967b845b63172601fe459667d973b7e6b7",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            },
            {
              "lessThan": "738ec97b1855df6c08fe2369f798fa0b972e556b",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            },
            {
              "lessThan": "14d1e55dfd2cf4711bff164a6aaaddb783552134",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            },
            {
              "lessThan": "0cb2af2ea66ad8ff195c156ea690f11216285bdf",
              "status": "affected",
              "version": "6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected GFN\n\nThe shadow MMU computes GFNs for direct shadow pages using sp-\u003egfn plus\nthe SPTE index. This assumption breaks for shadow paging if the guest\npage tables are modified between VM entries (similar to commit\naad885e77496, \"KVM: x86/mmu: Drop/zap existing present SPTE even\nwhen creating an MMIO SPTE\", 2026-03-27).  The flow is as follows:\n\n- a PDE is installed for a 2MB mapping, and a page in that area is\n  accessed.  KVM creates a kvm_mmu_page consisting of 512 4KB pages;\n  the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because\n  the guest\u0027s mapping is a huge page (and thus contiguous).\n\n- the PDE mapping is changed from outside the guest.\n\n- the guest accesses another page in the same 2MB area.  KVM installs\n  a new leaf SPTE and rmap entry; the SPTE uses the \"correct\" GFN\n  (i.e. based on the new mapping, as changed in the previous step) but\n  that GFN is outside of the [sp-\u003egfn, sp-\u003egfn + 511] range; therefore\n  the rmap entry cannot be found and removed when the kvm_mmu_page\n  is zapped.\n\n- the memslot that covers the first 2MB mapping is deleted, and the\n  kvm_mmu_page for the now-invalid GPA is zapped.  However, rmap_remove()\n  only looks at the [sp-\u003egfn, sp-\u003egfn + 511] range established in step 1,\n  and fails to find the rmap entry that was recorded by step 3.\n\n- any operation that causes an rmap walk for the same page accessed\n  by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page.\n  This includes dirty logging or MMU notifier invalidations (e.g., from\n  MADV_DONTNEED).\n\nThe underlying issue is that KVM\u0027s walking of shadow PTEs assumes that\nif a SPTE is present when KVM wants to install a non-leaf SPTE, then the\nexisting kvm_mmu_page must be for the correct gfn.  Because the only way\nfor the gfn to be wrong is if KVM messed up and failed to zap a SPTE...\nwhich shouldn\u0027t happen, but *actually* only happens in response to a\nguest write.\n\nThat bug dates back literally forever, as even the first version of KVM\nassumes that the GFN matches and walks into the \"wrong\" shadow page.\nHowever, that was only an imprecision until 2032a93d66fa (\"KVM: MMU:\nDon\u0027t allocate gfns page for direct mmu pages\") came along.\n\nFix it by checking for a target gfn mismatch and zapping the existing\nSPTE.  That way the old SP and rmap entries are gone, KVM installs\nthe rmap in the right location, and everyone is happy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires executing code inside a guest VM that takes shadow-paging page faults on the host CPU; there is no network protocol involved, so the vulnerable host MMU code is reached via local guest execution.\nAC:L - The guest deterministically controls its page-table contents and vCPU scheduling to create the mis-GFN\u0027d rmap, and the commit confirms the condition \"only happens in response to a guest write\"; the attacker can also drive the memslot-delete and rmap-walk triggers (BAR reprogramming, balloon/MADV_DONTNEED), so no condition lies beyond attacker control.\nPR:L - From the host\u0027s (vulnerable component\u0027s) perspective the attacker only needs the low privilege of running a guest VM, consistent with how guest-to-host KVM bugs are scored in this tree; full host-root is not required.\nUI:N - The malicious guest triggers the UAF autonomously through its own memory accesses and page-table edits with no action required from any host operator.\nS:C - A guest-context attacker corrupts host-kernel memory, crossing the VM/hypervisor security boundary into the host\u0027s authority (VM-escape class), exactly as other KVM guest-to-host issues are scored.\nC:H - The use-after-free leaves a stale rmap pointing at a freed kvm_mmu_page whose contents the attacker can reclaim/spray, yielding an arbitrary host-kernel read primitive.\nI:H - The stale rmap walk operates (drop_spte/write-protect/etc.) on attacker-reclaimed freed memory, providing a write/control-flow-hijack primitive in the host kernel \u2014 i.e. full host integrity compromise.\nA:H - Dereferencing the freed kvm_mmu_page during dirty logging or MMU-notifier invalidation reliably crashes/panics the host kernel, taking down the hypervisor and all co-resident guests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:55:31.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9597963a8ca16259d194a1d9950d7bd22a10ab2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9d4ea13aa2b6400bb10ec64b370ba3dadcd22f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/488e386484ec8c0e558be6e156edf34ed9f4d5c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/06c19c967b845b63172601fe459667d973b7e6b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/738ec97b1855df6c08fe2369f798fa0b972e556b"
        },
        {
          "url": "https://git.kernel.org/stable/c/14d1e55dfd2cf4711bff164a6aaaddb783552134"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cb2af2ea66ad8ff195c156ea690f11216285bdf"
        }
      ],
      "title": "KVM: x86: Fix shadow paging use-after-free due to unexpected GFN",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46113",
    "datePublished": "2026-05-28T09:35:23.035Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-10-19T19:26:44.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:39371

BDU:2026-11328 (CVE-2026-46116)

CVE-2025-38653 (GCVE-0-2025-38653)

CVE-2025-68183 (GCVE-0-2025-68183)

CVE-2025-68724 (GCVE-0-2025-68724)

CVE-2026-31408 (GCVE-0-2026-31408)

CVE-2026-43027 (GCVE-0-2026-43027)

CVE-2026-43074 (GCVE-0-2026-43074)

CVE-2026-43330 (GCVE-0-2026-43330)

CVE-2026-43414 (GCVE-0-2026-43414)

CVE-2026-46113 (GCVE-0-2026-46113)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour