{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64114",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:36:31.414892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:12.671Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/raw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1065b9efa4126df559b03a849c139ecfae92cd25",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bc20dbd48c26e743f7e0845020c11ed2ce8b15ee",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5a564f737ec54d63e8ee221d3ff396d07586d464",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "145e9afa5b905229b4788bb72c3255f5a5f77508",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7725cd3b471740fd23d25ed1da722c671fb2a5d3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "915fab69823a14c170dbaa3b41978768e0fe62fc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/raw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n    iphlen = iph-\u003eihl * 4;\n    err = -EINVAL;\n    if (iphlen \u003e length)\n        goto error_free;\n\n    if (iphlen \u003e= sizeof(*iph)) {\n        /* fix up saddr, tot_len, id, csum, transport_header */\n    }\n\nIt does not, however, reject ihl \u003c 5.  For such a packet the\n\"if (iphlen \u003e= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward.  Downstream consumers that read\niph-\u003eihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph-\u003eihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl \u003c 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\").  The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen \u003c sizeof(*iph)\" alongside the existing\n\"iphlen \u003e length\" check.  This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen \u003e= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly.  A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph-\u003eihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y.  The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns.  Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site.  Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl \u003e= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:23.263Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9"
        },
        {
          "url": "https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508"
        },
        {
          "url": "https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc"
        }
      ],
      "title": "ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64114",
    "datePublished": "2026-07-19T15:40:14.854Z",
    "dateReserved": "2026-07-19T07:54:57.035Z",
    "dateUpdated": "2026-10-19T20:28:12.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64266",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:38:01.546912Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:16.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f9156714592356b4fda57beac7eab9c2a462dd3",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "5630da218a45ba80f0aba0846cbe8aa655da122b",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "1ca605cfa59377f0143fb35b5b01360f37d1b7c4",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "0e4a5a000123d81234e27a2f8187688cf608f755",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "e6aa539720c3d8def69683ed0c07cf9faea4e8be",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "be353caffa8640f5e25fb3714ce8b0cef5e410e5",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "65a1c2551f7e16085acbb54aedde1feaa559ba7a",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "b5befa80fdbe287a98480effed9564712924add5",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before returning from fuse_ref_folio()\n\nfuse_ref_folio() unlocks the request but does not re-lock it before\nreturning. fuse_chan_abort() can end the request and the async end\ncallback (eg fuse_writepage_free()) can free the args while the\nsubsequent copy chain logic after fuse_ref_folio() accesses them,\nleading to use-after-free issues.\n\nFix this by locking the request in fuse_ref_folio() before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:20.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be"
        },
        {
          "url": "https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5"
        }
      ],
      "title": "fuse: re-lock request before returning from fuse_ref_folio()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64266",
    "datePublished": "2026-07-25T08:49:15.142Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-10-19T20:28:16.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_trie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d0778571def598c31e84a38ae5a7ebc6f65e6d8",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "bb03350f974aec352b660d032a1d283eb462165a",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "6429c9cfd941e62acd7bb0bc64d631574d4c3b2a",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "8150b5365f026e72250cacc527ea00be30f40105",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "d007056868723de9c0cc3f5ffaad47a8d468b9a4",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "cb8be318b4432abd88d3172ec157330f27a5f7a7",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "b8d2ea75c76abcd0d72679c2f488271f573e32fb",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "f2f152e94a67bc746afaf05a1b2702c195553112",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_trie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: free fib_alias with kfree_rcu() on insert error path\n\nfib_table_insert() publishes new_fa into the leaf\u0027s fa_list with\nfib_insert_alias() before calling the fib entry notifiers. When a\nnotifier fails, the error path removes new_fa with fib_remove_alias()\n(hlist_del_rcu) and frees it right away with kmem_cache_free().\n\nfib_table_lookup() walks that list under rcu_read_lock() only, so a\nconcurrent lookup that already reached new_fa keeps reading it after the\nfree:\n\n BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)\n Read of size 1 at addr ffff88810676d4eb by task exploit/297\n Call Trace:\n  fib_table_lookup (net/ipv4/fib_trie.c:1601)\n  ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)\n  ip_route_output_key_hash (net/ipv4/route.c:2705)\n  __ip4_datagram_connect (net/ipv4/datagram.c:49)\n  udp_connect (net/ipv4/udp.c:2144)\n  __sys_connect (net/socket.c:2167)\n  __x64_sys_connect (net/socket.c:2173)\n  do_syscall_64\n  entry_SYSCALL_64_after_hwframe\n which belongs to the cache ip_fib_alias of size 56\n\nTriggering the error path needs CAP_NET_ADMIN and a registered fib\nnotifier that can reject a route; a netdevsim device whose IPv4 FIB\nresource is exhausted is enough.\n\nFree new_fa with alias_free_mem_rcu(), as fib_table_delete() already\ndoes for a fib_alias removed from the trie."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:49.541Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d0778571def598c31e84a38ae5a7ebc6f65e6d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb03350f974aec352b660d032a1d283eb462165a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6429c9cfd941e62acd7bb0bc64d631574d4c3b2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8150b5365f026e72250cacc527ea00be30f40105"
        },
        {
          "url": "https://git.kernel.org/stable/c/d007056868723de9c0cc3f5ffaad47a8d468b9a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb8be318b4432abd88d3172ec157330f27a5f7a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8d2ea75c76abcd0d72679c2f488271f573e32fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2f152e94a67bc746afaf05a1b2702c195553112"
        }
      ],
      "title": "ipv4: fib: free fib_alias with kfree_rcu() on insert error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64572",
    "datePublished": "2026-08-05T08:08:09.068Z",
    "dateReserved": "2026-07-19T15:36:31.797Z",
    "dateUpdated": "2026-08-19T16:28:49.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68202",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:45:51.106270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:57.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7feeaca1f53b10df9b4de9eaf611767ca70dc92",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7478ef94b49bc9789cf1a003deec58b42283dde4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "24f0cabf173539f048946c8fc221131dc221f277",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6a10025c7fd09a7d2af37a3ae1da188569fce470",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "31a6163e301d832060f8236f1ed17cbc1ca198df",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: close a re-opened queue timer in the destructor\n\nqueue_delete() closes the queue timer, then frees it. snd_seq_timer_close()\nclears q-\u003etimer-\u003etimeri. snd_use_lock_sync() then drains borrowers, and\nsnd_seq_timer_delete() frees q-\u003etimer.\n\nA borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT\nthat took a queueptr() use_lock reference before the queue was unlinked\nruns snd_seq_timer_open() after the close. Open refuses re-open only while\ntimeri is set, and the close just cleared it, so it re-opens timeri.\n\nsnd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()\nis a no-op, because running was cleared first. So it frees q-\u003etimer with the\ninstance still live. The queue is freed next.\n\nThe instance stays on the global timer with callback_data pointing at the\nfreed queue. A non-owner START on the unlocked queue arms it. The next tick\nderefs the freed queue in snd_seq_timer_interrupt().\n\nReachable by an unprivileged user with access to /dev/snd/seq. No CAP and\nno queue ownership required.\n\nClose any lingering instance in the destructor. There, -\u003etimeri can no\nlonger change: the queue is unlinked and all use_lock borrowers have\ndrained, so no snd_seq_queue_use() can re-open it. Close it before clearing\nq-\u003etimer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt()\nto finish, and that callback still reads q-\u003etimer (via snd_seq_check_queue()),\nso q-\u003etimer must stay valid until it drains."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race \u2014 one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference \u2014 and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker\u0027s own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic \u2014 a repeatable denial of service for any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:08.116Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7feeaca1f53b10df9b4de9eaf611767ca70dc92"
        },
        {
          "url": "https://git.kernel.org/stable/c/7478ef94b49bc9789cf1a003deec58b42283dde4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07"
        },
        {
          "url": "https://git.kernel.org/stable/c/24f0cabf173539f048946c8fc221131dc221f277"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a10025c7fd09a7d2af37a3ae1da188569fce470"
        },
        {
          "url": "https://git.kernel.org/stable/c/31a6163e301d832060f8236f1ed17cbc1ca198df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9"
        }
      ],
      "title": "ALSA: seq: close a re-opened queue timer in the destructor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68202",
    "datePublished": "2026-08-10T12:00:21.279Z",
    "dateReserved": "2026-07-30T09:28:09.374Z",
    "dateUpdated": "2026-10-19T20:58:57.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80536",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:16:45.666700Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:25.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_buf_item_recover.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "acb4e26295e7f0e685815a3fd3d70bd8329cefa1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f3859c35a4fbc1c1c58431f684f808e43696891d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f7b5fa83e2c192be922121b764415fa8c7549ea1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b7528b42813f02724a78fce1da24d69d1bfc4d38",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7e32d4eebae6ca24f8a673c107fd7eca1f47afc2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f8288214459ead7e87d26e5822f62c14a4f2ed6b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "edaf5b6bd625356893da20d69a259b34a9de2694",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "813f8136a2ce1fee266d02a7df73db6e8a541604",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_buf_item_recover.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bounds-check buffer log item\u0027s dirty bitmap\n\nxlog_recover_do_reg_buffer() replays each dirty region described by a\nbuffer log item\u0027s bitmap into the buffer read for that item:\n\n\tmemcpy(xfs_buf_offset(bp, (uint)bit \u003c\u003c XFS_BLF_SHIFT),\n\t\titem-\u003eri_buf[i].iov_base,\n\t\tnbits \u003c\u003c XFS_BLF_SHIFT);\n\nThe destination offset (bit/nbits, from the logged dirty bitmap) and the\nbuffer size (from the logged blf_len) are both attacker-controlled and\notherwise unrelated, yet the only thing bounding the copy is an ASSERT(),\nwhich compiles away on production kernels. A crafted image logging a\nsmall blf_len together with a bitmap bit past the end of that buffer\ndrives the memcpy() past the buffer\u0027s allocation, corrupting adjacent\nkernel heap during mount-time log recovery. This is reachable by anyone\nwho can get a crafted image mounted -- the malicious-filesystem threat\nmodel XFS already guards against elsewhere.\n\nTurn the ASSERT() into a real XFS_IS_CORRUPT() check that aborts recovery\nof the buffer with -EFSCORRUPTED, consistent with the validate-and-fail\nidiom already used in xlog_recover_do_inode_buffer() and\nxfs_dquot_item_recover.c. xlog_recover_do_reg_buffer() therefore becomes\nSTATIC int and its three callers propagate the error.\n\nFound and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted\nimage trips a slab-out-of-bounds write before this change and fails\nrecovery cleanly with -EFSCORRUPTED after it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB write is only reachable during XFS log recovery at mount time (mount\u2192xfs_mountfs\u2192xfs_log_mount\u2192xlog_recover\u2192xlog_do_recovery_pass pass2\u2192xlog_recover_buf_commit_pass2\u2192xlog_recover_do_reg_buffer); attacker data comes from a local block/loop device image, not from any network protocol handler.\nAC:L - All trigger fields (blf_len, blf_data_map bit/nbits, and logged source bytes in ri_buf) are attacker-authored on-disk log metadata; pairing a small blf_len with a bitmap region past the buffer end deterministically drives memcpy() past the xfs_buf allocation on every mount with no race or uncontrollable layout.\nPR:N - Mounting the crafted image requires no account or capability on the victim host in the malicious-filesystem threat model: an external attacker only supplies removable media or a disk image and desktop/kiosk udisks2 or systemd automount performs the privileged mount on device insertion without attacker credentials.\nUI:N - Once the crafted XFS volume is presented to the host, log recovery in xlog_recover_do_reg_buffer() runs automatically during mount (including read-only mounts) before any file access; the attacker needs no separate victim to open files, click links, or perform additional actions beyond presenting the image.\nS:U - Heap corruption occurs entirely within the mounting host kernel during log replay; impact is confined to the same kernel security authority and does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - KASAN-confirmed slab-out-of-bounds write corrupts adjacent kernel heap objects; such controlled memory corruption is routinely weaponized for arbitrary kernel read primitives and pointer disclosure, not merely a crash.\nI:H - memcpy() writes attacker-controlled bytes from logged ri_buf regions to attacker-chosen offsets beyond the buffer end, giving a controllable out-of-bounds kernel heap write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - The unchecked memcpy() causes slab-out-of-bounds writes during mount-time recovery (KASAN-verified on CONFIG_XFS_DEBUG=n), reliably corrupting kernel heap and capable of provoking kernel oops/panic or persistent denial of service on repeated mount attempts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:04.524Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/acb4e26295e7f0e685815a3fd3d70bd8329cefa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3859c35a4fbc1c1c58431f684f808e43696891d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7b5fa83e2c192be922121b764415fa8c7549ea1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7528b42813f02724a78fce1da24d69d1bfc4d38"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e32d4eebae6ca24f8a673c107fd7eca1f47afc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8288214459ead7e87d26e5822f62c14a4f2ed6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/edaf5b6bd625356893da20d69a259b34a9de2694"
        },
        {
          "url": "https://git.kernel.org/stable/c/813f8136a2ce1fee266d02a7df73db6e8a541604"
        }
      ],
      "title": "xfs: bounds-check buffer log item\u0027s dirty bitmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80536",
    "datePublished": "2026-08-26T14:37:11.584Z",
    "dateReserved": "2026-08-26T14:34:25.765Z",
    "dateUpdated": "2026-10-16T19:26:25.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80590",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:18:13.413771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:29.280Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_fragment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "29dda278a5ed272f2230ff4eaa23cf403107bba0",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "69b73b74d9eb45f5560a8fe4fa406ada580e1340",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "da857e448322a2e871ce3ecc2900027041160d43",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "d5dc1e69fd7258ea605c9952e5d5947539159ae3",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_fragment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.268",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.219",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.186",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.155",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.107",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.48",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.12",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.2",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n  kernel BUG at net/core/skbuff.c:4899!\n  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n  CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n  RIP: 0010:skb_segment+0x20ca/0x48b0\n  Call Trace:\n   \u003cTASK\u003e\n   __udp_gso_segment+0x29a/0x27d0\n   udp4_ufo_fragment+0x458/0x6c0\n   inet_gso_segment+0x429/0x1340\n   skb_mac_gso_segment+0x233/0x4f0\n   __skb_gso_segment+0x308/0x660\n   udp_queue_rcv_skb+0x440/0xad0\n   udp_unicast_rcv_skb+0xc7/0x2c0\n   udp_rcv+0x16ce/0x2260\n   ip_protocol_deliver_rcu+0x197/0x2d0\n   ip_local_deliver+0x430/0x690\n   ip_rcv+0x16f/0x1f0\n   __netif_receive_skb_one_core+0x15e/0x1c0\n   __netif_receive_skb+0x1e/0x110\n   netif_receive_skb+0xf6/0x5c0\n   tun_rx_batched.isra.0+0x3ab/0x790\n   tun_get_user+0x17c3/0x3550\n   tun_chr_write_iter+0xba/0x1b0\n   vfs_write+0x646/0x1130\n   \u003c/TASK\u003e\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious cloud VM guest injects virtio_net_hdr-marked IPv4/IPv6 fragments through virtio-net/vhost-tap into the host ip_rcv() path; the same inet_frag reassembly and skb_segment() crash also fires on validate_xmit_skb()/ip_finish_output_gso() when such skbs traverse forwarding.\nAC:L - The attacker fully controls virtio_net_hdr gso_type/gso_size and fragment geometry; the commit reproduces a host panic from two tap writes with no races, timing, or uncontrollable memory layout required.\nPR:N - On typical KVM/QEMU tap-backed virtio-net deployments a tenant VM needs no host account or capability; exploitation uses only the pre-provisioned virtual NIC, not init-namespace root or CAP_NET_ADMIN on the host.\nUI:N - Packet injection, ip_defrag reassembly, and GSO segmentation run automatically in softirq once crafted virtio fragments are sent; no victim mount, click, or other cooperative action is required.\nS:C - A guest VM tenant can panic the host kernel by crossing the hypervisor virtio/tap boundary, impacting resources outside the guest security authority even though the demonstrated primitive is denial of service rather than full escape.\nC:N - Impact is an intentional BUG_ON in skb_segment() frag_list handling; there is no demonstrated out-of-bounds read, use-after-free, or other information-disclosure primitive before the assertion aborts.\nI:N - The failure aborts in skb_segment() before any out-of-bounds write, page-desc conversion, or control-flow hijack; attacker-controlled metadata only reaches a defensive assertion, not a memory modification primitive.\nA:H - Triggering skb_segment() BUG_ON from tun_rx/tun_get_user runs with BH disabled and causes a fatal kernel panic, fully and repeatedly denying availability of the affected host until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:43:12.426Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
        },
        {
          "url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
        },
        {
          "url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
        },
        {
          "url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
        },
        {
          "url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
        },
        {
          "url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
        },
        {
          "url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
        }
      ],
      "title": "inet: frags: strip GSO state from fragments before reassembly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80590",
    "datePublished": "2026-08-28T06:35:12.516Z",
    "dateReserved": "2026-08-26T14:34:25.770Z",
    "dateUpdated": "2026-10-19T08:43:12.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb84cd81040e58dd05ac190f561f2115e3367249",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "f0eea8f9013676b42289ec35941e848b8a543e19",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "d665a1688af7f8fefd7c0eb04f2a37122ce007f4",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "25cdd2a492d868cff1e519a60fe282909c52d385",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "812f1db7f0755a19ef16ecdc5cec51bcabc5eda5",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "533d0c5feef85ee6404b9f41d5564fac6971a008",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "fda8fb7e8179561693a786a7af593f6b944a21c1",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "dc77acfeb979dded39b247b60fef0399536bfa77",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac370e3d1f3b01519d2705cd5815d1c9d0a8812b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be363e27ec3c3a99793da2be6c07eafb95709c6b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1b10ba5739440ca51d66f0b2949cead88d2dd02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde3433de9a067a33d67d65b9093cad3e043e49e",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.155",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.85",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.155",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.85",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\n\nvfio_msi_cap_len() lazily allocates the per-device MSI permission table:\n\n\tvdev-\u003emsi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);\n\tif (!vdev-\u003emsi_perm)\n\t\treturn -ENOMEM;\n\n\tret = init_pci_cap_msi_perm(vdev-\u003emsi_perm, len, flags);\n\tif (ret) {\n\t\tkfree(vdev-\u003emsi_perm);\n\t\treturn ret;\t\t/* vdev-\u003emsi_perm left dangling */\n\t}\n\nWhen init_pci_cap_msi_perm() -\u003e alloc_perm_bits() fails with -ENOMEM, the\nerror path frees vdev-\u003emsi_perm but leaves the freed pointer stored in\nit. vdev-\u003emsi_perm is not re-zeroed later because struct\nvfio_pci_core_device is per-device and persists across open/close cycles,\nand the vfio_config_init() error path returns without calling\nvfio_config_free(). So the dangling pointer outlives the failed open.\n\nThat leads to two use-after-frees on the same device:\n\n1. Reuse. The next vfio_config_init() sees the stale pointer at\n   \"if (vdev-\u003emsi_perm) return len;\" and reuses the freed object. MSI\n   config accesses in vfio_pci_config_rw_single() then dereference and\n   call the freed perm-\u003ereadfn / perm-\u003ewritefn function pointers.\n\n2. Double free. A later vfio_config_free() runs free_perm_bits() and\n   kfree() on the already-freed object.\n\nFix it by NULLing vdev-\u003emsi_perm after the kfree(), matching the\nNULL-after-free discipline already used in free_perm_bits() and\nvfio_config_free().\n\n  BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n  Read of size 8 at addr ffff88800fcc88d0 by task exploit/143\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n   vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)\n   vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)\n   vfs_read (fs/read_write.c:572)\n   __x64_sys_pread64 (fs/read_write.c:764)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n\nFollowed on device close by a double free of the same object:\n\n  Oops: general protection fault, probably for non-canonical address\n    0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:kfree (mm/slub.c:6711)\n  Call Trace:\n   vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)\n   vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)\n   vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)\n   vfio_df_close (drivers/vfio/vfio_main.c:602)\n   vfio_device_fops_release (drivers/vfio/vfio_main.c:648)\n   __fput (fs/file_table.c:512)\n   __x64_sys_close (fs/open.c:1496)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only via local VFIO char-device operations: open of /dev/vfio/$GROUP or /dev/vfio/devices/vfioN, then pread/pwrite of the PCI config region through vfio_pci_core_read/write into vfio_pci_config_rw_single(). There is no network or packet path into vfio_msi_cap_len().\nAC:L - After any failed vfio_config_init() plants the dangling vdev-\u003emsi_perm, the attacker retries GET_DEVICE_FD/BIND_IOMMUFD on the same persistent vdev and deterministically calls the freed perm-\u003ereadfn/writefn via MSI config accesses. The attacker controls that open/read sequence; no victim race or uncontrolled layout is required.\nPR:L - vfio_pci_core_enable() and vfio_pci_config_rw() have no capable() check on the normal IOMMU path (CAP_SYS_RAWIO is only for noiommu). Access is gated by /dev/vfio node permissions, which libvirt, kubevirt, and cloud GPU/NIC passthrough routinely grant to an unprivileged qemu user or tenant.\nUI:N - The attacker performs the VFIO open, retry, and MSI config-space pread/pwrite themselves. Prior admin binding of the PCI device to vfio-pci is deployment configuration, not victim interaction during exploitation.\nS:C - struct vfio_pci_core_device persists across open/close, so a failed open can leave a dangling msi_perm that a later tenant VM reuses. QEMU services guest PCI config cycles with VFIO pread/pwrite, so a passthrough guest can invoke the freed host function pointers and cross the VFIO/IOMMU guest-to-host boundary.\nC:H - The next successful open reuses the freed perm_bits and MSI config reads call perm-\u003ereadfn on that object. Reclaiming the slab slot yields an arbitrary kernel-read primitive, which CVSS kernel guidance scores High for use-after-free.\nI:H - MSI config writes call the freed perm-\u003ewritefn, and a later close double-frees the same object in vfio_config_free(). That UAF/double-free of a structure with function pointers is exploitable for arbitrary kernel write and control-flow hijack.\nA:H - The report shows a KASAN slab-use-after-free in vfio_pci_config_rw_single() followed by a general-protection fault in kfree() during vfio_config_free() that panics the host, so availability impact is a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:52:29.546Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385"
        },
        {
          "url": "https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5"
        },
        {
          "url": "https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77"
        }
      ],
      "title": "vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89777",
    "datePublished": "2026-09-16T08:48:17.754Z",
    "dateReserved": "2026-09-11T19:38:34.765Z",
    "dateUpdated": "2026-10-19T08:52:29.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}