{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e796001af97a1f7368d5114b7a8533dd98d797a",
              "status": "affected",
              "version": "335176dd8ebaca6493807dceea33c478305667fa",
              "versionType": "git"
            },
            {
              "lessThan": "604da9c04c218362e1c1457304ebeb9c199d537c",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "lessThan": "c4c7219e93319bba9ba0765dee597784c78f63c5",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "lessThan": "4d390f0e507dfb16d58f83a58d78d1150dc8b9d7",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "lessThan": "9e07e3b81807edd356e1f794cffa00a428eff443",
              "status": "affected",
              "version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "02871710b93058eb1249d5847c0b2d1c2c3c98ae",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.134",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/thermal_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Fix thermal zone device registration error path\n\nIf thermal_zone_device_register_with_trips() fails after registering\na thermal zone device, it needs to wait for the tz-\u003eremoval completion\nlike thermal_zone_device_unregister(), in case user space has managed\nto take a reference to the thermal zone device\u0027s kobject, in which case\nthermal_release() may not be called by the error path itself and tz may\nbe freed prematurely.\n\nAdd the missing wait_for_completion() call to the thermal zone device\nregistration error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is thermal zone registration/error handling exposed through local kernel device/sysfs activity, not through remote packets or an adjacent/physical protocol.\nAC:L - The race is between local userspace taking a sysfs/kobject reference and the registration error path dropping the device reference; a local attacker can influence the reference side and resource pressure, so under the overestimate rule this is low complexity.\nPR:L - No capability is needed to take references to readable thermal sysfs objects, and a basic local user can race that exposure; root-only debugfs testing paths also exist, but the higher-severity defensible metric is low privileges.\nUI:N - Exploitation does not require a separate victim to open a file or mount anything; the attacker can run local code to monitor/open the thermal sysfs object during registration failure.\nS:U - The corrupted object is in the kernel thermal core and impacts the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossing.\nC:H - The missing wait can free the thermal zone while a kobject reference keeps release deferred, producing a use-after-free on a kernel object; such memory corruption can be leveraged for kernel memory disclosure.\nI:H - The delayed release path dereferences and frees fields from the prematurely freed thermal zone, giving exploitable heap corruption/use-after-free conditions that can support arbitrary modification or code execution.\nA:H - Even without full exploitation, the use-after-free in the device release path can cause kernel oops/panic or heap corruption, resulting in high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:17.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e796001af97a1f7368d5114b7a8533dd98d797a"
        },
        {
          "url": "https://git.kernel.org/stable/c/604da9c04c218362e1c1457304ebeb9c199d537c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4c7219e93319bba9ba0765dee597784c78f63c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d390f0e507dfb16d58f83a58d78d1150dc8b9d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e07e3b81807edd356e1f794cffa00a428eff443"
        }
      ],
      "title": "thermal: core: Fix thermal zone device registration error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43332",
    "datePublished": "2026-05-08T13:31:19.460Z",
    "dateReserved": "2026-05-01T14:12:56.002Z",
    "dateUpdated": "2026-08-05T12:27:17.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/macsec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd7306779c6ce1238f4cdc34f3c1f2246b854457",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "d15130461df388136b62a7b0ce9f66e7e2fa9ff1",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "23c0e230eab397d7f68be2538790ac41d3bb91fd",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "679e13a65e68a67c8b3c0467c02ee89157ec6f0f",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "79495a1b0944fe31ffd54b54b00211b493590d62",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "d55acbe577db892b60547b6ef1c020b359331a6d",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            },
            {
              "lessThan": "e68842b3356471ba56c882209f324613dac47f64",
              "status": "affected",
              "version": "a21ecf0e033807b976967286e6c392f48ee2049f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/macsec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacsec: fix replay protection at XPN lower-PN wrap\n\nIn macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0\nand the first branch never fires. If next_pn_halves.lower is also in the\nupper half, pn_same_half(pn, lower) is true and the XPN else-if does not\nfire either, leaving next_pn_halves unchanged. An attacker that captures\nthe legitimate frame carrying pn == 0xFFFFFFFF on an XPN association\ncan then replay it indefinitely, since lowest_pn never rises above\nthe captured pn and macsec_decrypt() reconstructs the same IV.\n\nExtend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt\nof pn == U32_MAX advances next_pn_halves to (upper + 1, 0)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - MACsec processes attacker-supplied Ethernet frames via netdev rx_handler on the underlying link; exploitation requires L2 adjacency on the same broadcast domain or point-to-point MACsec link, not remote Internet reachability.\nAC:L - Once XPN with replay protection is deployed, an on-link attacker can passively capture the single legitimate frame at PN 0xFFFFFFFF and then replay it reliably and indefinitely without races or conditions outside their control.\nPR:N - Exploitation requires only the ability to send or replay Ethernet frames on the MACsec link; no local privileges, capabilities, or authentication on the victim Linux host are needed.\nUI:N - Replay injection is fully attacker-driven after capturing the target frame; no victim user or administrator action is required during exploitation.\nS:U - The flaw bypasses MACsec replay protection within the kernel network stack and does not cross a security boundary such as a VM, container, or IOMMU isolation domain.\nC:N - This is a replay-protection logic flaw, not a memory corruption or decryption weakness; the attacker replays already-captured ciphertext and gains no new confidentiality beyond what passive capture already provided.\nI:H - Bypassing replay protection allows unlimited re-injection of previously authenticated payloads into the controlled port, defeating MACsec\u0027s integrity guarantees and enabling repeated delivery of captured control or data traffic on automotive, industrial, and datacenter MACsec links.\nA:H - The commit confirms captured frames can be replayed indefinitely, enabling sustained injection of decrypted traffic that can overwhelm the receiver and deny service to legitimate peers on the protected link."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:20.197Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd7306779c6ce1238f4cdc34f3c1f2246b854457"
        },
        {
          "url": "https://git.kernel.org/stable/c/d15130461df388136b62a7b0ce9f66e7e2fa9ff1"
        },
        {
          "url": "https://git.kernel.org/stable/c/23c0e230eab397d7f68be2538790ac41d3bb91fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/679e13a65e68a67c8b3c0467c02ee89157ec6f0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/79495a1b0944fe31ffd54b54b00211b493590d62"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652"
        },
        {
          "url": "https://git.kernel.org/stable/c/d55acbe577db892b60547b6ef1c020b359331a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e68842b3356471ba56c882209f324613dac47f64"
        }
      ],
      "title": "macsec: fix replay protection at XPN lower-PN wrap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63925",
    "datePublished": "2026-07-19T14:55:26.442Z",
    "dateReserved": "2026-07-19T07:54:57.021Z",
    "dateUpdated": "2026-08-05T12:37:20.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-stub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e9072dbd5f2f17934751873450d2c22080ead80",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "21e87f336ac6303fed54a69b1d0d79a23b25c8d0",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "3fd225f3e4cd67ec8ddab1afed9da03c7c43537c",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "1c4ffe6b4f04365485ed58d64c9bb86b46fc9037",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "4bd8635f28c135a08aac6badcd7d9b5cdb34335f",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "5f4d2bd028ebb6e4c09a9d64842546022321d4a7",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "0526931b16e5a118d367b7bfce7d797e63f7ac69",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-stub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.37",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.14",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n  \u003cTASK\u003e\n  stub_xfer (drivers/i2c/i2c-stub.c:223)\n  __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n  i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n  i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n  i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n  __x64_sys_ioctl (fs/ioctl.c:583)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by a local process issuing I2C_SMBUS ioctls on an i2c-stub /dev/i2c-* character device; it is neither remotely nor physically reachable.\nAC:L - Once i2c-stub is loaded, the attacker controls the address, direction, length, and register contents, making the corruption deterministic without a race. The non-default module configuration defines the vulnerable deployment rather than complicating exploitation within it.\nPR:L - The attacker needs unprivileged local access to the applicable /dev/i2c-* node, but no capability or namespace-specific administrative privilege is checked anywhere along the ioctl path.\nUI:N - After the vulnerable adapter is configured, exploitation requires only attacker-issued ioctls and no action by another user.\nS:U - The corruption occurs within the host kernel and represents conventional local privilege escalation, without crossing a separate virtualization or hardware security authority.\nC:H - An oversized block write reads up to 222 bytes beyond the 34-byte stack union and persists those bytes in attacker-readable stub registers, enabling substantial kernel-stack disclosure.\nI:H - An oversized block read writes up to 222 attacker-chosen bytes beyond the stack union because the attacker can prepopulate the stub registers, enabling control-data corruption and potential kernel code execution.\nA:H - The controlled stack overwrite can corrupt stack canaries, return state, or other control data, causing a repeatable kernel oops or panic even when code execution is unsuccessful."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:59.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80"
        },
        {
          "url": "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69"
        },
        {
          "url": "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e"
        }
      ],
      "title": "i2c: stub: Reject I2C block transfers with invalid length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64191",
    "datePublished": "2026-07-20T16:27:51.120Z",
    "dateReserved": "2026-07-19T07:54:57.040Z",
    "dateUpdated": "2026-08-05T12:39:59.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0be4bc64882edaefaaee8d1e27d083643eb778e6",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "96fcfc8ae7359346156e492ca610e830d2649ad6",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "276c8efbc49f9303ac76d0d4deab7128581b0f3b",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "fc65ffb4ef1bf540da16b17c225ae51091e07d72",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_ioctl() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_ioctl_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel\u0027s periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:37.258Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6"
        },
        {
          "url": "https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_ioctl() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64385",
    "datePublished": "2026-07-25T08:50:33.997Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:37.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/nospec-branch.h",
            "arch/x86/kernel/cpu/bugs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25dbcd31781e2bc3cd63d873af1fcd06f863a126",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "cb27f3bf915cc0f20fc0c48da9059304e39ebd35",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "9354248fc1c33a844ca1872761f6668b393e8c37",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "52440e15d9628f8f239373c0f2e5e8f92feea2df",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "a3af84b0fa00ead01fcd0e28b5d773ff25990a0d",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/nospec-branch.h",
            "arch/x86/kernel/cpu/bugs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:18.513Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25dbcd31781e2bc3cd63d873af1fcd06f863a126"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35"
        },
        {
          "url": "https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d"
        }
      ],
      "title": "x86/bugs: Enable IBPB flush on BPF JIT allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64507",
    "datePublished": "2026-07-25T08:52:01.008Z",
    "dateReserved": "2026-07-19T15:36:31.793Z",
    "dateUpdated": "2026-08-19T16:28:18.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/filter.h",
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1fbafd5235ca897b322161659ebe8ba651b00b3b",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "6e52c240c43a601b681e3a4e58fc5685114d4726",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "eed774da601268dae674e14d54a15e3624691f52",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "8ff183ee4d8c452960df58175a094828c0513b2e",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "7a6c171c6a1ac6d1509752dac131d941a3de0b37",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            },
            {
              "lessThan": "96cce16e26dd02a8678f1e87f88a4b5cdb63b995",
              "status": "affected",
              "version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/filter.h",
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don\u0027t reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:20.972Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1fbafd5235ca897b322161659ebe8ba651b00b3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726"
        },
        {
          "url": "https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37"
        },
        {
          "url": "https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995"
        }
      ],
      "title": "bpf: Support for hardening against JIT spraying",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64508",
    "datePublished": "2026-07-25T08:52:01.732Z",
    "dateReserved": "2026-07-19T15:36:31.793Z",
    "dateUpdated": "2026-08-19T16:28:20.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c",
            "net/openvswitch/datapath.c",
            "net/openvswitch/datapath.h",
            "net/openvswitch/vport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50a6a85f3d6b1d22d8436848606cdef5d2c490b4",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "2623c48cc3a8da9a1886fd8f65c0e348f4406fd6",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "e211b081901ffca76674082c73eeaed53524c369",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "100a23b1613e9218e0af654ef102352c713f0263",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "ea85dbcbe8d4056ecb54352f97743d138ea4c407",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            },
            {
              "lessThan": "4032f8ed10fcb84d41c508dfb04be96589f78dfe",
              "status": "affected",
              "version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c",
            "net/openvswitch/datapath.c",
            "net/openvswitch/datapath.h",
            "net/openvswitch/vport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix GSO userspace truncation underflow\n\nOVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb\nlength in OVS_CB(skb)-\u003ecutlen. When a later userspace action segments a\nGSO skb, queue_gso_packets() reuses that delta for each smaller segment.\nA segment can then reach queue_userspace_packet() with cutlen greater\nthan skb-\u003elen, underflowing the length passed to skb_zerocopy().\n\nStore the maximum preserved length instead and bound each consumer\nagainst the current skb length. Use U32_MAX as the no-truncation\nsentinel so the value remains valid if skb geometry changes before a\nconsumer handles it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Ingress packets reach ovs_vport_receive() through netdev rx_handlers or tunnel vports; GRO-coalesced GSO skbs from remote senders traverse this path into queue_gso_packets(), so the underflow is reachable from the network without physical access.\nAC:L - The attacker chooses truncation max_len relative to GSO super-skb size and sends traffic that GRO segments predictably; no timing race or fragile heap layout is required to make cutlen exceed a child segment length after __skb_gso_segment().\nPR:N - In multi-tenant cloud/OVN deployments, a remote VM or container can send crafted GSO traffic into the host OVS datapath to hit provider-installed TRUNC+USERSPACE sampling flows without possessing any Linux capabilities on the host.\nUI:N - Triggering the flaw requires only network traffic matching existing OVS flow actions; no victim login, file open, mount, or other interactive step is needed.\nS:U - Impact is kernel memory corruption and crash/escalation within the host kernel security domain; it does not cross a guest-to-hypervisor, VM, or hardware IOMMU trust boundary by itself.\nC:H - Unsigned underflow makes skb-\u003elen-cutlen enormous for skb_zerocopy()/skb_copy_bits(), enabling out-of-bounds reads from the source skb and adjacent slab data, i.e., an exploitable information-disclosure primitive.\nI:H - The same underflowed length can expand destination skbs via skb_len_add()/nlattr sizing, corrupting kernel heap metadata and yielding a write primitive suitable for control-flow hijacking.\nA:H - The miscopied lengths can BUG the skb helpers or cause immediate kernel oops/panic during zerocopy/trim handling, and corrupted metadata can crash the system even if exploitation is not completed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:34.391Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50a6a85f3d6b1d22d8436848606cdef5d2c490b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2623c48cc3a8da9a1886fd8f65c0e348f4406fd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e211b081901ffca76674082c73eeaed53524c369"
        },
        {
          "url": "https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407"
        },
        {
          "url": "https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe"
        }
      ],
      "title": "openvswitch: fix GSO userspace truncation underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68123",
    "datePublished": "2026-08-10T11:58:43.727Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-19T16:29:34.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3893e1fcf6f306b327a8358dcd1cbd077989a240",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "da2d249a39a1881681c303ceea33f38ba1c5bbeb",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "654be81c4c637af12709d47c7efc3302cd336513",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "e363c0bc0226dc5ea5046a88e9a6864b82c45399",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "0658b09cba7fe866c6cd70cd2dcdfdcabe80328f",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            },
            {
              "lessThan": "0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe",
              "status": "affected",
              "version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Check the interrupt is still ours before migrating it\n\nvgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating\nan interrupt to another vCPU. After reacquiring the locks it only checks\nthat the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))\nbefore moving the interrupt, which assumes that an interrupt whose affinity\nis preserved is still queued on this vCPU\u0027s ap_list.\n\nThat assumption no longer holds if the interrupt is taken off the ap_list\nwhile the locks are dropped. vgic_flush_pending_lpis() removes the\ninterrupt from the list and sets irq-\u003evcpu to NULL, but leaves\nenabled/pending/target_vcpu untouched. As the interrupt is still enabled\nand pending, vgic_target_oracle() returns the same target_vcpu, so the\naffinity check passes and list_del() is run a second time on an entry that\nhas already been removed.\n\nAlso check that the interrupt is still assigned to this vCPU\n(irq-\u003evcpu == vcpu) before moving it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only from KVM guest execution paths\u2014GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()\u2014not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU\u0027s ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker\u0027s VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU\u0027s ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU\u0027s ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:24.760Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3893e1fcf6f306b327a8358dcd1cbd077989a240"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/da2d249a39a1881681c303ceea33f38ba1c5bbeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/654be81c4c637af12709d47c7efc3302cd336513"
        },
        {
          "url": "https://git.kernel.org/stable/c/e363c0bc0226dc5ea5046a88e9a6864b82c45399"
        },
        {
          "url": "https://git.kernel.org/stable/c/79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/0658b09cba7fe866c6cd70cd2dcdfdcabe80328f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe"
        }
      ],
      "title": "KVM: arm64: vgic: Check the interrupt is still ours before migrating it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72289",
    "datePublished": "2026-08-15T05:55:10.870Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:24.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "76c607b9353d377b1d1b11db50e743eee0ccf658",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "d64b6be5740ce230aca184d8d224c75d9866045d",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "929a85932d14190988f1eafd6ee8cc68d66ace0b",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "b784cd1c24d89bf71be2efe1e948ff7c03371e57",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "c37abc99bb3de3d3219ecef253d649f74117fd83",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "027a84ac6b50c12ef767c15abfc58aa865820e9e",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote malicious SMB/DFS server delivers the malformed DFS referral reply over the network when the CIFS client issues FSCTL_DFS_GET_REFERRALS (SMB2) or TRANS2_GET_DFS_REFERRAL (SMB1); no local or physical access is required to reach parse_dfs_referrals().\nAC:L - Once a client session exists, the attacker fully controls referral header fields and per-entry DfsPathOffset/NetworkAddressOffset in the reply; no races, timing, or victim-specific memory layout are needed to trigger the out-of-bounds read reliably.\nPR:N - Exploitation requires no privileges on the victim host\u2014the attacker only needs to operate the SMB server returning the malicious DFS referral; the client kernel parses the response regardless of which local user triggered the referral lookup.\nUI:N - After a DFS CIFS mount or autofs/enterprise logon mount, referral lookups and periodic dfs_cache_refresh work run automatically on file access and reconnect without any additional deliberate user action beyond normal SMB/DFS client use.\nS:U - The flaw corrupts/confidentiality-impacts kernel memory in the same security authority as the CIFS client; it does not by itself cross a hypervisor, IOMMU, or container sandbox boundary distinct from standard kernel compromise.\nC:H - Unvalidated string offsets let DfsPath/NetworkAddress pointers sit past the response buffer; the resulting negative max_len is cast to size_t for kstrndup()/strnlen(), enabling large out-of-bounds reads of adjacent kernel memory (SMB1/non-Unicode path).\nI:L - The bug is an out-of-bounds read that copies attacker-influenced kernel bytes into newly allocated heap buffers rather than an arbitrary write primitive, but heap contents are modified beyond the intended referral data scope.\nA:H - Reading past the SMB response buffer can oops/panic the kernel on unmapped pages, and casting a negative max_len to size_t can drive very large strnlen()/allocation attempts, causing severe denial of service on servers and workstations using DFS mounts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:44.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658"
        },
        {
          "url": "https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d"
        },
        {
          "url": "https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57"
        },
        {
          "url": "https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83"
        },
        {
          "url": "https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e"
        }
      ],
      "title": "cifs: validate DFS referral string offsets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72318",
    "datePublished": "2026-08-15T05:55:31.682Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-08-17T05:42:44.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b6c2842692d08e7acaf32d1eb47f95def35f3fe",
              "status": "affected",
              "version": "5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a",
              "versionType": "git"
            },
            {
              "lessThan": "6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33",
              "status": "affected",
              "version": "de7921631ff323369aa63a4324695ab54ea4047e",
              "versionType": "git"
            },
            {
              "lessThan": "1293fd69a50d188a5788b08ba3741a3e86be1608",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "fe198b077864feafd4aa4b33b1a5ce26f50195a2",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "e3702470ced94fad74d71e2232f022d2eb752a6d",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "594d905195024b228c962627ae5ae7c17bd582a4",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.189",
              "status": "affected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "6.6.93",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n   1) Create two SCCs:\n\n       X -.   A \u003c-\u003e B\n       ^--\u0027\n\n   2) Run the following concurrently:\n\n      2-1) send() sk-B to sk-B from sk-X\n      2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n       X -.   A \u003c-\u003e B -. This edge is visible\n       ^--\u0027         ^..\u0027  but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n       X -.   A \u003c.\u003e B -.\n       ^--\u0027         ^--\u0027\n\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B\u0027s scc_entry.\n\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable through local AF_UNIX syscalls (socket/sendmsg with SCM_RIGHTS and close) that drive unix_add_edges(), unix_del_edge(), and unix_gc(); AF_UNIX is host-local IPC with no remote packet, Bluetooth, WiFi, or physical bus entry path.\nAC:L - Exploitation requires racing sendmsg() (scm_stat_add/unix_add_edges before skb_queue_tail) against concurrent close() that triggers GC; the attacker controls both threads, can pin CPUs, and can retry until the window is hit, so success does not depend on conditions outside attacker control.\nPR:L - An unprivileged local user can create AF_UNIX sockets, pass socket file descriptors via SCM_RIGHTS to form inflight reference cycles, and close sockets to schedule unix_gc(); no real-root capabilities, special namespaces, or non-default kernel configuration are required.\nUI:N - The attacker sets up the cyclic inflight graph, performs the concurrent self-send and close operations, and forces garbage collection from its own processes; no separate victim user action or cooperating peer is needed beyond the attacker\u0027s own sockets.\nS:U - The use-after-free corrupts kernel heap/list state during AF_UNIX garbage collection within the same kernel security authority; exploitation yields standard local privilege escalation rather than crossing a VM, IOMMU, or inter-tenant sandbox boundary.\nC:H - Freed struct unix_vertex objects remain linked through stale scc_entry; unix_walk_scc_fast(), unix_scc_dead(), and unix_collect_skb() dereference freed vertex-\u003eedges and predecessor socket receive queues, giving a slab UAF read primitive controllable through heap grooming.\nI:H - The same UAF enables reclaiming freed vertices and influencing GC list iteration and skb_queue_splice_init() during unix_collect_skb(), providing memory corruption primitives suitable for arbitrary kernel writes, control-flow hijack, and local privilege escalation.\nA:H - Iterating or collecting through a freed vertex reliably triggers kernel oops/panic (KASAN slab-use-after-free), and corrupt GC graph state can crash the host or deny service to local workloads even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:56:06.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33"
        },
        {
          "url": "https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"
        }
      ],
      "title": "af_unix: Unlink scc_entry in unix_del_edge().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80521",
    "datePublished": "2026-08-26T14:37:02.589Z",
    "dateReserved": "2026-08-26T14:34:25.763Z",
    "dateUpdated": "2026-10-03T10:56:06.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}