Action not permitted
Modal body text goes here.
Modal Title
Modal Body
alsa-2026:67469
Vulnerability from osv_almalinux
Published
2026-09-15 00:00
Modified
2026-09-15 08:14
Summary
Important: kernel-rt security update
Details
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
- kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
- kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)
- kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
- kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
- kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
- kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
- kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
- kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
- kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
- kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
- kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
- kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.163.1.rt7.504.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. \n\nSecurity Fix(es): \n\n * kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)\n * kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)\n * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)\n * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)\n * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)\n * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)\n * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)\n * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb (CVE-2026-64117)\n * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)\n * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)\n * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)\n * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:67469",
"modified": "2026-09-15T08:14:01Z",
"published": "2026-09-15T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:67469"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-53161"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-71127"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-43133"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-52947"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53182"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63802"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63889"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-64117"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68294"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68363"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-72098"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-74556"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2333977"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2429587"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2467065"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492432"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492722"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502251"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502320"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502477"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2513286"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2513353"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2516501"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2517010"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-67469.html"
}
],
"related": [
"CVE-2024-53161",
"CVE-2025-71127",
"CVE-2026-43133",
"CVE-2026-52947",
"CVE-2026-53182",
"CVE-2026-63802",
"CVE-2026-63889",
"CVE-2026-64117",
"CVE-2026-68363",
"CVE-2026-68294",
"CVE-2026-72098",
"CVE-2026-74556"
],
"summary": "Important: kernel-rt security update"
}
CVE-2024-53161 (GCVE-0-2024-53161)
Vulnerability from cvelistv5 – Published: 2024-12-24 11:29 – Updated: 2026-05-11 20:52
VLAI
EPSS
VEX
Title
EDAC/bluefield: Fix potential integer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
EDAC/bluefield: Fix potential integer overflow
The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx
left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as
32-bits wide the left-shift operation truncates the upper 16 bits of
information during the calculation of the SMC argument.
The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any
potential integer overflow, i.e. loss of data from upper 16 bits.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:09 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/8cc31cfa36ff37aff… | |
| https://git.kernel.org/stable/c/e0269ea7a628fdedd… | |
| https://git.kernel.org/stable/c/4ad7033de109d0fec… | |
| https://git.kernel.org/stable/c/578ca89b04680145d… | |
| https://git.kernel.org/stable/c/ac6ebb9edcdb7077e… | |
| https://git.kernel.org/stable/c/fdb90006184aa84c7… | |
| https://git.kernel.org/stable/c/000930193fe5eb79c… | |
| https://git.kernel.org/stable/c/1fe774a93b46bb029… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
82413e562ea6eadfb6de946dcc6f74af31d64e7f , < 8cc31cfa36ff37aff399b72faa2ded58110112ae
(git)
Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < e0269ea7a628fdeddd65b92fe29c09655dbb80b9 (git) Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < 4ad7033de109d0fec99086f352f58a3412e378b8 (git) Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < 578ca89b04680145d41011e7cec8806fefbb59e7 (git) Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < ac6ebb9edcdb7077e841862c402697c4c48a7c0a (git) Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < fdb90006184aa84c7b4e09144ed0936d4e1891a7 (git) Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < 000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5 (git) Affected: 82413e562ea6eadfb6de946dcc6f74af31d64e7f , < 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 5.4.287 , ≤ 5.4.* (semver) Unaffected: 5.10.231 , ≤ 5.10.* (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.64 , ≤ 6.6.* (semver) Unaffected: 6.11.11 , ≤ 6.11.* (semver) Unaffected: 6.12.2 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-53161",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-01T20:09:22.869656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T20:17:08.107Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:46:52.800Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/edac/bluefield_edac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8cc31cfa36ff37aff399b72faa2ded58110112ae",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "e0269ea7a628fdeddd65b92fe29c09655dbb80b9",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "4ad7033de109d0fec99086f352f58a3412e378b8",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "578ca89b04680145d41011e7cec8806fefbb59e7",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "ac6ebb9edcdb7077e841862c402697c4c48a7c0a",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "fdb90006184aa84c7b4e09144ed0936d4e1891a7",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
},
{
"lessThan": "1fe774a93b46bb029b8f6fa9d1f25affa53f06c6",
"status": "affected",
"version": "82413e562ea6eadfb6de946dcc6f74af31d64e7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/edac/bluefield_edac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.287",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.231",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.174",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.120",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.64",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.11",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.2",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/bluefield: Fix potential integer overflow\n\nThe 64-bit argument for the \"get DIMM info\" SMC call consists of mem_ctrl_idx\nleft-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as\n32-bits wide the left-shift operation truncates the upper 16 bits of\ninformation during the calculation of the SMC argument.\n\nThe mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any\npotential integer overflow, i.e. loss of data from upper 16 bits."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T20:52:00.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8cc31cfa36ff37aff399b72faa2ded58110112ae"
},
{
"url": "https://git.kernel.org/stable/c/e0269ea7a628fdeddd65b92fe29c09655dbb80b9"
},
{
"url": "https://git.kernel.org/stable/c/4ad7033de109d0fec99086f352f58a3412e378b8"
},
{
"url": "https://git.kernel.org/stable/c/578ca89b04680145d41011e7cec8806fefbb59e7"
},
{
"url": "https://git.kernel.org/stable/c/ac6ebb9edcdb7077e841862c402697c4c48a7c0a"
},
{
"url": "https://git.kernel.org/stable/c/fdb90006184aa84c7b4e09144ed0936d4e1891a7"
},
{
"url": "https://git.kernel.org/stable/c/000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5"
},
{
"url": "https://git.kernel.org/stable/c/1fe774a93b46bb029b8f6fa9d1f25affa53f06c6"
}
],
"title": "EDAC/bluefield: Fix potential integer overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53161",
"datePublished": "2024-12-24T11:29:01.938Z",
"dateReserved": "2024-11-19T17:17:25.002Z",
"dateUpdated": "2026-05-11T20:52:00.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71127 (GCVE-0-2025-71127)
Vulnerability from cvelistv5 – Published: 2026-01-14 15:07 – Updated: 2026-08-05 12:12
VLAI
EPSS
VEX
Title
wifi: mac80211: Discard Beacon frames to non-broadcast address
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Discard Beacon frames to non-broadcast address
Beacon frames are required to be sent to the broadcast address, see IEEE
Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the Beacon .. frame
shall be set to the broadcast address"). A unicast Beacon frame might be
used as a targeted attack to get one of the associated STAs to do
something (e.g., using CSA to move it to another channel). As such, it
is better have strict filtering for this on the received side and
discard all Beacon frames that are sent to an unexpected address.
This is even more important for cases where beacon protection is used.
The current implementation in mac80211 is correctly discarding unicast
Beacon frames if the Protected Frame bit in the Frame Control field is
set to 0. However, if that bit is set to 1, the logic used for checking
for configured BIGTK(s) does not actually work. If the driver does not
have logic for dropping unicast Beacon frames with Protected Frame bit
1, these frames would be accepted in mac80211 processing as valid Beacon
frames even though they are not protected. This would allow beacon
protection to be bypassed. While the logic for checking beacon
protection could be extended to cover this corner case, a more generic
check for discard all Beacon frames based on A1=unicast address covers
this without needing additional changes.
Address all these issues by dropping received Beacon frames if they are
sent to a non-broadcast address.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:41 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/be0974be5c42584e0… | |
| https://git.kernel.org/stable/c/0a59a3895f8044692… | |
| https://git.kernel.org/stable/c/88aab153d1528bc55… | |
| https://git.kernel.org/stable/c/6e5bff40bb38741e4… | |
| https://git.kernel.org/stable/c/7b240a8935d554ad3… | |
| https://git.kernel.org/stable/c/a21704df4024708be… | |
| https://git.kernel.org/stable/c/193d18f60588e95d6… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
af2d14b01c32d7cba65f73503586e5b621afb139 , < be0974be5c42584e027883ac2af7dab5e950098c
(git)
Affected: af2d14b01c32d7cba65f73503586e5b621afb139 , < 0a59a3895f804469276d188effa511c72e752f35 (git) Affected: af2d14b01c32d7cba65f73503586e5b621afb139 , < 88aab153d1528bc559292a12fb5105ee97528e1f (git) Affected: af2d14b01c32d7cba65f73503586e5b621afb139 , < 6e5bff40bb38741e40c33043ba0816fba5f93661 (git) Affected: af2d14b01c32d7cba65f73503586e5b621afb139 , < 7b240a8935d554ad36a52c2c37c32039f9afaef2 (git) Affected: af2d14b01c32d7cba65f73503586e5b621afb139 , < a21704df4024708be698fb3fd5830d5b113b70e0 (git) Affected: af2d14b01c32d7cba65f73503586e5b621afb139 , < 193d18f60588e95d62e0f82b6a53893e5f2f19f8 (git) |
|
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.65 , ≤ 6.12.* (semver) Unaffected: 6.18.4 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T20:41:39.095624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T18:44:14.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be0974be5c42584e027883ac2af7dab5e950098c",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
},
{
"lessThan": "0a59a3895f804469276d188effa511c72e752f35",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
},
{
"lessThan": "88aab153d1528bc559292a12fb5105ee97528e1f",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
},
{
"lessThan": "6e5bff40bb38741e40c33043ba0816fba5f93661",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
},
{
"lessThan": "7b240a8935d554ad36a52c2c37c32039f9afaef2",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
},
{
"lessThan": "a21704df4024708be698fb3fd5830d5b113b70e0",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
},
{
"lessThan": "193d18f60588e95d62e0f82b6a53893e5f2f19f8",
"status": "affected",
"version": "af2d14b01c32d7cba65f73503586e5b621afb139",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.65",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.248",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.198",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.160",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.65",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Discard Beacon frames to non-broadcast address\n\nBeacon frames are required to be sent to the broadcast address, see IEEE\nStd 802.11-2020, 11.1.3.1 (\"The Address 1 field of the Beacon .. frame\nshall be set to the broadcast address\"). A unicast Beacon frame might be\nused as a targeted attack to get one of the associated STAs to do\nsomething (e.g., using CSA to move it to another channel). As such, it\nis better have strict filtering for this on the received side and\ndiscard all Beacon frames that are sent to an unexpected address.\n\nThis is even more important for cases where beacon protection is used.\nThe current implementation in mac80211 is correctly discarding unicast\nBeacon frames if the Protected Frame bit in the Frame Control field is\nset to 0. However, if that bit is set to 1, the logic used for checking\nfor configured BIGTK(s) does not actually work. If the driver does not\nhave logic for dropping unicast Beacon frames with Protected Frame bit\n1, these frames would be accepted in mac80211 processing as valid Beacon\nframes even though they are not protected. This would allow beacon\nprotection to be bypassed. While the logic for checking beacon\nprotection could be extended to cover this corner case, a more generic\ncheck for discard all Beacon frames based on A1=unicast address covers\nthis without needing additional changes.\n\nAddress all these issues by dropping received Beacon frames if they are\nsent to a non-broadcast address."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An attacker must inject crafted 802.11 Beacon frames within radio range of the target on its current Wi-Fi channel, making this an adjacent attack.\nAC:L - The target MAC, AP BSSID, and channel are observable, and a crafted Beacon can directly trigger the flaw without a race or condition beyond the attacker\u2019s control.\nPR:N - The receive path performs no attacker privilege or authentication check, and the attacker does not need to associate with the protected network or possess PTK/BIGTK material.\nUI:N - The kernel automatically processes the injected Beacon while the station is associated, without any victim action.\nS:U - The vulnerability affects Wi-Fi management state and availability within the same host kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:N - The flaw provides no memory disclosure or protected-data read capability, and the affected parsing path shows no out-of-bounds read or use-after-free.\nI:L - Forged Beacons can make unauthorized but bounded changes to channel, bandwidth, transmit power, QoS, and MLO link state, without arbitrary memory modification or code execution.\nA:H - An attacker can force channel switching, block transmit queues, or trigger disconnection, and repeated unauthenticated injection can sustain complete loss of Wi-Fi connectivity."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:12:13.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be0974be5c42584e027883ac2af7dab5e950098c"
},
{
"url": "https://git.kernel.org/stable/c/0a59a3895f804469276d188effa511c72e752f35"
},
{
"url": "https://git.kernel.org/stable/c/88aab153d1528bc559292a12fb5105ee97528e1f"
},
{
"url": "https://git.kernel.org/stable/c/6e5bff40bb38741e40c33043ba0816fba5f93661"
},
{
"url": "https://git.kernel.org/stable/c/7b240a8935d554ad36a52c2c37c32039f9afaef2"
},
{
"url": "https://git.kernel.org/stable/c/a21704df4024708be698fb3fd5830d5b113b70e0"
},
{
"url": "https://git.kernel.org/stable/c/193d18f60588e95d62e0f82b6a53893e5f2f19f8"
}
],
"title": "wifi: mac80211: Discard Beacon frames to non-broadcast address",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71127",
"datePublished": "2026-01-14T15:07:44.218Z",
"dateReserved": "2026-01-13T15:30:19.655Z",
"dateUpdated": "2026-08-05T12:12:13.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43133 (GCVE-0-2026-43133)
Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-09-15 12:04
VLAI
EPSS
VEX
Title
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload
of guest state") made KVM always use vmcb01 for the fields controlled by
VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code
to always use vmcb01.
As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not
intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01
instead of the current VMCB.
Severity
7.9 (High)
CWE
- CWE-628 - Function Call with Incorrectly Specified Arguments
Assigner
References
15 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/10063e1251c148503… | |
| https://git.kernel.org/stable/c/c3b7015000988ba35… | |
| https://git.kernel.org/stable/c/3880e331b0b31d0d5… | |
| https://git.kernel.org/stable/c/fce2fd4a2ca05670a… | |
| https://git.kernel.org/stable/c/d464cf1ed900d47c8… | |
| https://git.kernel.org/stable/c/0004ecb798b30e90d… | |
| https://git.kernel.org/stable/c/127ccae2c185f62e6… | |
| https://access.redhat.com/security/cve/CVE-2026-43133 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2467065 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:66357 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:65334 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:66180 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67468 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67469 | vendor-advisoryx_refsource_REDHAT |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cc3ed80ae69f454c3d904af9f65394a540099723 , < 10063e1251c1485034a018236080792ad083dcc5
(git)
Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < c3b7015000988ba35ecd5648f4b2283960f00543 (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 3880e331b0b31d0d5d3702b124f6c93539cd478a (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < fce2fd4a2ca05670a91015aacccf96a1c26268fd (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < d464cf1ed900d47c85393d40b00017b6adfc2e6c (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 0004ecb798b30e90d7ebfe74efae2d9423315a64 (git) Affected: cc3ed80ae69f454c3d904af9f65394a540099723 , < 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619 (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:6.12.0-211.53.1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:5.14.0-687.46.1.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.53.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.46.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "libkrun",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-628",
"description": "Function Call with Incorrectly Specified Arguments",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T12:04:27.795Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43133"
},
{
"name": "RHBZ#2467065",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66357"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65334"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66180"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67468"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67469"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:66357: Red Hat OpenShift Container Platform 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:66180: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:67468: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:67469: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10063e1251c1485034a018236080792ad083dcc5",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "c3b7015000988ba35ecd5648f4b2283960f00543",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "3880e331b0b31d0d5d3702b124f6c93539cd478a",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "fce2fd4a2ca05670a91015aacccf96a1c26268fd",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "d464cf1ed900d47c85393d40b00017b6adfc2e6c",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "0004ecb798b30e90d7ebfe74efae2d9423315a64",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "127ccae2c185f62e6ecb4bf24f9cb307e9b9c619",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by locally running a KVM vCPU through /dev/kvm and executing nested SVM VMLOAD/VMSAVE from an L2 guest; it is not reachable via network packets.\nAC:L - The trigger is deterministic once nested SVM is available: configure L1 not to intercept VMLOAD/VMSAVE and execute the instruction in L2. No race or attacker-uncontrolled timing condition is required.\nPR:L - The attacker needs the ability to create/run a KVM VM or execute code in a nested guest, which is local low privilege where /dev/kvm is delegated. No real init-namespace root capability is required by the vulnerable emulation path itself.\nUI:N - After the VM/nested guest is running, exploitation is triggered solely by guest instruction execution. No additional victim user action is required.\nS:C - The bug is in KVM\u2019s enforcement of the nested virtualization boundary, where L2 execution causes KVM to operate on the wrong L0-maintained VMCB state. That can affect resources outside the L2 guest\u2019s own security authority.\nC:L - VMSAVE can copy bounded VMLOAD/VMSAVE save-state fields from the wrong internal VMCB into guest-accessible memory. I did not identify an arbitrary host-memory read primitive, so the defensible confidentiality impact is limited.\nI:L - VMLOAD can corrupt a bounded set of VMLOAD/VMSAVE state fields in the wrong KVM VMCB, causing incorrect nested guest/L1 state handling. I did not find a direct arbitrary host write or host code execution primitive.\nA:H - The wrong VMCB state can make nested VM execution fail or crash/hang the affected virtual machine/vCPU, and the attacker can trigger it repeatedly. This is a complete availability impact for the affected nested virtualization workload, even though I did not find a host kernel panic path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:09.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5"
},
{
"url": "https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543"
},
{
"url": "https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a"
},
{
"url": "https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd"
},
{
"url": "https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c"
},
{
"url": "https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64"
},
{
"url": "https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619"
}
],
"title": "KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43133",
"datePublished": "2026-05-06T11:27:20.882Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-09-15T12:04:27.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52947 (GCVE-0-2026-52947)
Vulnerability from cvelistv5 – Published: 2026-06-24 16:26 – Updated: 2026-08-05 12:31
VLAI
EPSS
VEX
Title
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
In qrtr_port_remove(), the socket reference count is decremented via
__sock_put() before the port is removed from the qrtr_ports XArray and
before the RCU grace period elapses.
This breaks the fundamental RCU update paradigm. It exposes a race
window where a concurrent RCU reader (such as qrtr_reset_ports() or
qrtr_port_lookup()) can obtain a pointer to the socket from the XArray,
and attempt to call sock_hold() on a socket whose reference count has
already dropped to zero.
This exact race condition was hit during syzkaller fuzzing, leading to
the following refcount saturation warning and a potential Use-After-Free:
refcount_t: saturated; leaking memory.
WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0
Modules linked in: qrtr(+) bochs drm_shmem_helper ...
Call Trace:
<TASK>
qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]
__qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]
qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]
kernel_bind+0xe4/0x120 net/socket.c:3592
qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]
qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]
do_one_initcall+0xf5/0x5e0 init/main.c:1283
...
</TASK>
Fix this by deferring the reference count decrement until after the
xa_erase() and the synchronize_rcu() complete.
(Note: The v1 of this patch incorrectly replaced __sock_put() with
sock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()
still hold a reference to the socket, so freeing the socket memory here
would lead to a subsequent UAF in the caller. Thus, the __sock_put() is
kept, but only repositioned to close the RCU race.)
Severity
7.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/2aa4c12723fe432e6… | |
| https://git.kernel.org/stable/c/03bfa95e452e2b6cc… | |
| https://git.kernel.org/stable/c/474293d90880622fd… | |
| https://git.kernel.org/stable/c/2047c2aa0963bb287… | |
| https://git.kernel.org/stable/c/7de2d447072be3b1a… | |
| https://git.kernel.org/stable/c/ab269990ed58143a9… | |
| https://git.kernel.org/stable/c/3b20ec8f31e8a6a67… | |
| https://git.kernel.org/stable/c/a2171131ecda1ed61… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 2aa4c12723fe432e623462a3be42a197a128722b
(git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 03bfa95e452e2b6ccd76a332060ae4feaf5ad84d (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 474293d90880622fde9d2430fb0165767090f7b3 (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 2047c2aa0963bb2872fd722300a15bcb441a4c00 (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 7de2d447072be3b1a76793f034432338fc9c494b (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < ab269990ed58143a92a263be1bee626d82ac03da (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 3b20ec8f31e8a6a6782243f473b0abd3463621df (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < a2171131ecda1ed61a594a1eb715e75fdad0fef5 (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/qrtr/af_qrtr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2aa4c12723fe432e623462a3be42a197a128722b",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "03bfa95e452e2b6ccd76a332060ae4feaf5ad84d",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "474293d90880622fde9d2430fb0165767090f7b3",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "2047c2aa0963bb2872fd722300a15bcb441a4c00",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "7de2d447072be3b1a76793f034432338fc9c494b",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "ab269990ed58143a92a263be1bee626d82ac03da",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "3b20ec8f31e8a6a6782243f473b0abd3463621df",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "a2171131ecda1ed61a594a1eb715e75fdad0fef5",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/qrtr/af_qrtr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n refcount_t: saturated; leaking memory.\n WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n Call Trace:\n \u003cTASK\u003e\n qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n kernel_bind+0xe4/0x120 net/socket.c:3592\n qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n do_one_initcall+0xf5/0x5e0 init/main.c:1283\n ...\n \u003c/TASK\u003e\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reachable through local AF_QIPCRTR datagram sockets via bind/autobind, sendmsg lookup, rebind, and close/release; QRTR transports are local IPC/internal device transports rather than Internet-facing network services. A local unprivileged process on a QRTR-enabled system can create and race these sockets.\nAC:L - Although this is a race, the attacker can control both sides by repeatedly removing bound QRTR ports while concurrently causing QRTR port lookups through local sends or other QRTR activity. Syzkaller reached the race, and there are no special external conditions beyond attacker-driven concurrency.\nPR:L - Creating AF_QIPCRTR sockets and binding ephemeral or high-numbered QRTR ports does not require CAP_NET_ADMIN or root. Control-port binding has extra checks, but exploitation does not depend on becoming the controller.\nUI:N - No victim action is required once the attacker has local code execution. The attacker can create sockets, bind/send/close them, and run the race directly.\nS:U - The corruption is within the kernel networking/QRTR subsystem and does not cross a separate security authority such as a VM, IOMMU, or sandbox boundary. A local kernel compromise remains unchanged scope.\nC:H - The bug is a potential use-after-free of a QRTR socket object reachable through stale XArray/RCU lookups and refcount resurrection. Per kernel scoring guidance, UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A UAF on a kernel socket object can potentially be shaped with heap spraying into write or control-flow primitives. When uncertain, this should be scored as high integrity impact rather than only a crash.\nA:H - The observed failure is a refcount saturation warning on a stale socket reference, and the underlying UAF can lead to kernel oops, panic, or memory corruption. This is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:58.784Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"
},
{
"url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"
},
{
"url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"
},
{
"url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"
},
{
"url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"
},
{
"url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"
},
{
"url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"
},
{
"url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"
}
],
"title": "net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52947",
"datePublished": "2026-06-24T16:26:05.062Z",
"dateReserved": "2026-06-09T07:44:35.371Z",
"dateUpdated": "2026-08-05T12:31:58.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53182 (GCVE-0-2026-53182)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-08-05 12:33
VLAI
EPSS
VEX
Title
wifi: nl80211: reject oversized EMA RNR lists
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: reject oversized EMA RNR lists
nl80211_parse_rnr_elems() stores the parsed element count in a
u8-backed cfg80211_rnr_elems::cnt field and uses that count to size
the flexible array allocation.
Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches
255, before incrementing it again. This keeps the parser aligned with
the data structure it fills and matches the existing bound check used
by nl80211_parse_mbssid_elems().
Severity
7.8 (High)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/fc0ec2fc02dfe52c5… | |
| https://git.kernel.org/stable/c/688fcac7054abc680… | |
| https://git.kernel.org/stable/c/30c3fa80f423613ef… | |
| https://git.kernel.org/stable/c/265c07c09c8376217… | |
| https://git.kernel.org/stable/c/ecbf3c45add30a085… | |
| https://git.kernel.org/stable/c/4cd92957e8f8cc4eb… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
56189d7bc30531def6b999f27940ee43c6ff2569 , < fc0ec2fc02dfe52c5821f36fbccf6a45df43f508
(git)
Affected: dbbb27e183b1568d5a907ace1cd144b0709ea52a , < 688fcac7054abc680c0eef753f2bb772cfaf8cf7 (git) Affected: dbbb27e183b1568d5a907ace1cd144b0709ea52a , < 30c3fa80f423613efdda3deca4af52ff7d20e4e2 (git) Affected: dbbb27e183b1568d5a907ace1cd144b0709ea52a , < 265c07c09c837621730d35f02975207a1224bf05 (git) Affected: dbbb27e183b1568d5a907ace1cd144b0709ea52a , < ecbf3c45add30a0857414e156bdb9c79906f0ff6 (git) Affected: dbbb27e183b1568d5a907ace1cd144b0709ea52a , < 4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1 (git) Affected: 6.1.160 , < 6.1.176 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc0ec2fc02dfe52c5821f36fbccf6a45df43f508",
"status": "affected",
"version": "56189d7bc30531def6b999f27940ee43c6ff2569",
"versionType": "git"
},
{
"lessThan": "688fcac7054abc680c0eef753f2bb772cfaf8cf7",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "30c3fa80f423613efdda3deca4af52ff7d20e4e2",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "265c07c09c837621730d35f02975207a1224bf05",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "ecbf3c45add30a0857414e156bdb9c79906f0ff6",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.160",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject oversized EMA RNR lists\n\nnl80211_parse_rnr_elems() stores the parsed element count in a\nu8-backed cfg80211_rnr_elems::cnt field and uses that count to size\nthe flexible array allocation.\n\nReject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches\n255, before incrementing it again. This keeps the parser aligned with\nthe data structure it fills and matches the existing bound check used\nby nl80211_parse_mbssid_elems()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable parser is reached through local nl80211 generic-netlink commands that configure AP beacon data, not by received WiFi frames or remote network traffic.\nAC:L - An attacker who can send the command can deterministically provide 256 or more nested EMA RNR elements; there is no race or condition outside the attacker\u0027s control beyond targeting an affected AP-capable configuration.\nPR:L - The commands require CAP_NET_ADMIN via GENL_UNS_ADMIN_PERM, which is checked in the relevant network namespace; under kernel scoring guidance this is low privilege because CAP_NET_ADMIN may be available through user namespaces.\nUI:N - No victim action is required after the attacker sends the crafted nl80211 request.\nS:U - The corruption occurs inside the kernel and impacts the same kernel security authority; it is not a VM escape or other cross-scope boundary violation.\nC:H - The u8 count wrap causes an undersized flexible-array allocation followed by attacker-influenced out-of-bounds heap writes, which is memory corruption plausibly usable for kernel memory disclosure.\nI:H - The bug is a kernel heap out-of-bounds write of RNR element metadata past the allocation, making arbitrary corruption or control-flow compromise defensible.\nA:H - The same heap corruption can readily crash or panic the kernel even if not weaponized for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:48.954Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc0ec2fc02dfe52c5821f36fbccf6a45df43f508"
},
{
"url": "https://git.kernel.org/stable/c/688fcac7054abc680c0eef753f2bb772cfaf8cf7"
},
{
"url": "https://git.kernel.org/stable/c/30c3fa80f423613efdda3deca4af52ff7d20e4e2"
},
{
"url": "https://git.kernel.org/stable/c/265c07c09c837621730d35f02975207a1224bf05"
},
{
"url": "https://git.kernel.org/stable/c/ecbf3c45add30a0857414e156bdb9c79906f0ff6"
},
{
"url": "https://git.kernel.org/stable/c/4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1"
}
],
"title": "wifi: nl80211: reject oversized EMA RNR lists",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53182",
"datePublished": "2026-06-25T08:38:56.654Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-08-05T12:33:48.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63802 (GCVE-0-2026-63802)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
EPSS
VEX
Title
blk-cgroup: fix UAF in __blkcg_rstat_flush()
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF in __blkcg_rstat_flush()
When multiple blkgs in the same blkcg are released concurrently,
a use-after-free can occur. The race happens when one blkg's
__blkcg_rstat_flush() removes another blkg's iostat entries via
llist_del_all(). The second blkg sees an empty list and proceeds
to free itself while the first is still iterating over its entries.
Move the flush from __blkg_release() (RCU callback) to blkg_release()
(before call_rcu). This ensures the RCU grace period waits for any
concurrent flush's rcu_read_lock() section to complete before freeing.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
20cb1c2fb7568a6054c55defe044311397e01ddb , < 96e545410c4f74c89d496c1d5d9ef8d08f14368b
(git)
Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < bbebd9425cad3573d1527441753899b926525a0f (git) Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < 5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6 (git) Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < afebe44facc48a61761e885bbb7f0380d4a603ec (git) Affected: 20cb1c2fb7568a6054c55defe044311397e01ddb , < 0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2 (git) Affected: 0f6090d90f627d8c58f939067d6c6821ce1b3c68 (git) Affected: 6.3.9 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96e545410c4f74c89d496c1d5d9ef8d08f14368b",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "bbebd9425cad3573d1527441753899b926525a0f",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "afebe44facc48a61761e885bbb7f0380d4a603ec",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"status": "affected",
"version": "0f6090d90f627d8c58f939067d6c6821ce1b3c68",
"versionType": "git"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF in __blkcg_rstat_flush()\n\nWhen multiple blkgs in the same blkcg are released concurrently,\na use-after-free can occur. The race happens when one blkg\u0027s\n__blkcg_rstat_flush() removes another blkg\u0027s iostat entries via\nllist_del_all(). The second blkg sees an empty list and proceeds\nto free itself while the first is still iterating over its entries.\n\nMove the flush from __blkg_release() (RCU callback) to blkg_release()\n(before call_rcu). This ensures the RCU grace period waits for any\nconcurrent flush\u0027s rcu_read_lock() section to complete before freeing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:07.787Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b"
},
{
"url": "https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f"
},
{
"url": "https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6"
},
{
"url": "https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec"
},
{
"url": "https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2"
}
],
"title": "blk-cgroup: fix UAF in __blkcg_rstat_flush()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63802",
"datePublished": "2026-07-19T12:02:08.020Z",
"dateReserved": "2026-07-19T07:54:57.013Z",
"dateUpdated": "2026-08-17T04:51:07.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63889 (GCVE-0-2026-63889)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:36
VLAI
EPSS
VEX
Title
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS
frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in
the generic FC transport. This is not a local userspace or IP network
path; the attacker must be able to inject fabric traffic, for example as
a compromised switch or fabric controller, or as a same-zone N_Port on a
fabric that permits source spoofing.
The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop
counter against the 32-bit on-wire pname_count field, and did not bound
pname_count by the descriptor body already validated by the TLV walker.
A pname_count of 256 therefore wraps the counter and keeps the loop
condition true indefinitely.
Factor the shared pname_list[] walk into one helper, widen the counter
to u32, and clamp pname_count against the entries that fit in the
descriptor body before iterating.
Severity
8.1 (High)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/07776b7779c942698… | |
| https://git.kernel.org/stable/c/29f126f09e34a425b… | |
| https://git.kernel.org/stable/c/163bd704d7515c3df… | |
| https://git.kernel.org/stable/c/ee57b89e5da9fffbe… | |
| https://git.kernel.org/stable/c/35461d23744175a78… | |
| https://git.kernel.org/stable/c/bdff76dff6ec23d6f… | |
| https://git.kernel.org/stable/c/a9a39233ec1fc9f97… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 07776b7779c9426982c1ad74aad91bd531593790
(git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 29f126f09e34a425b376b3646c89aa7cc18b142c (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 163bd704d7515c3df6c2e03bcba93d1db79edbff (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < ee57b89e5da9fffbe0d26647e4ff0750dacb9943 (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 35461d23744175a78b6280293892cca357c22793 (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770 (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "07776b7779c9426982c1ad74aad91bd531593790",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "29f126f09e34a425b376b3646c89aa7cc18b142c",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "163bd704d7515c3df6c2e03bcba93d1db79edbff",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "ee57b89e5da9fffbe0d26647e4ff0750dacb9943",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "35461d23744175a78b6280293892cca357c22793",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n\nAn adjacent Fibre Channel fabric actor that can deliver an FPIN ELS\nframe to an lpfc or qla2xxx Linux initiator can trigger a non-return in\nthe generic FC transport. This is not a local userspace or IP network\npath; the attacker must be able to inject fabric traffic, for example as\na compromised switch or fabric controller, or as a same-zone N_Port on a\nfabric that permits source spoofing.\n\nThe Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop\ncounter against the 32-bit on-wire pname_count field, and did not bound\npname_count by the descriptor body already validated by the TLV walker.\nA pname_count of 256 therefore wraps the counter and keeps the loop\ncondition true indefinitely.\n\nFactor the shared pname_list[] walk into one helper, widen the counter\nto u32, and clamp pname_count against the entries that fit in the\ndescriptor body before iterating."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Exploitation requires injecting a crafted FPIN ELS frame onto the Fibre Channel fabric from an adjacent fabric actor (compromised switch, fabric controller, or same-zone N_Port), not via IP or local syscalls.\nAC:L - Once on the fabric, an attacker can reliably trigger the bug by sending an FPIN with a Link-Integrity or Peer-Congestion descriptor containing pname_count=256 and a minimally valid TLV length; no race or special memory layout is required.\nPR:N - The attacker needs no privileges on the victim Linux host; FPIN ELS frames are processed without authentication once the HBA has completed fabric discovery.\nUI:N - No victim user action is required; the malicious FPIN is processed automatically when received by the HBA firmware and driver stack.\nS:U - Impact is confined to kernel availability and information disclosure on the affected host; it does not cross a security boundary such as VM escape or sandbox breakout.\nC:H - The unbounded loop reads pname_list[i] beyond the validated descriptor body via out-of-bounds kernel memory reads on every iteration, enabling information disclosure from adjacent kernel memory.\nI:N - The bug causes only counter increments in FPIN statistics structures on matched rports; there is no memory corruption or write primitive that could modify arbitrary data or achieve code execution.\nA:H - The infinite loop pins a CPU in kernel context (potentially from interrupt/DPC paths) and repeatedly acquires host_lock via fc_find_rport_by_wwpn(), causing soft lockup and complete loss of host availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:58.639Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790"
},
{
"url": "https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c"
},
{
"url": "https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff"
},
{
"url": "https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943"
},
{
"url": "https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793"
},
{
"url": "https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770"
},
{
"url": "https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153"
}
],
"title": "scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63889",
"datePublished": "2026-07-19T14:55:01.515Z",
"dateReserved": "2026-07-19T07:54:57.018Z",
"dateUpdated": "2026-08-05T12:36:58.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64117 (GCVE-0-2026-64117)
Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
EPSS
VEX
Title
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
ieee80211_invoke_fast_rx() reads RX status through
IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage
that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the
unicast forward path, mesh_data does:
info = IEEE80211_SKB_CB(fwd_skb);
memset(info, 0, sizeof(*info));
on the same skb the caller still names via rx->skb, then either
queues the skb for TX (success) or kfree_skb()'s it (no-route)
before returning RX_QUEUED. The caller's RX_QUEUED arm then
calls sta_stats_encode_rate(status) on memory that is either
zeroed (success path) or freed (no-route path). The latter is
KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.
Fix by encoding the rate from status before invoking
ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value
captured while status was still backed by valid memory.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3468e1e0c639032a603450f0830ccabfa76f5806 , < 2fb64f94f9afb774f2fa0c7835727d7a67f89f07
(git)
Affected: 3468e1e0c639032a603450f0830ccabfa76f5806 , < d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2fb64f94f9afb774f2fa0c7835727d7a67f89f07",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb\n\nieee80211_invoke_fast_rx() reads RX status through\nIEEE80211_SKB_RXCB(skb), which aliases the same skb-\u003ecb storage\nthat ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the\nunicast forward path, mesh_data does:\n\n\tinfo = IEEE80211_SKB_CB(fwd_skb);\n\tmemset(info, 0, sizeof(*info));\n\non the same skb the caller still names via rx-\u003eskb, then either\nqueues the skb for TX (success) or kfree_skb()\u0027s it (no-route)\nbefore returning RX_QUEUED. The caller\u0027s RX_QUEUED arm then\ncalls sta_stats_encode_rate(status) on memory that is either\nzeroed (success path) or freed (no-route path). The latter is\nKASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.\n\nFix by encoding the rate from status before invoking\nieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value\ncaptured while status was still backed by valid memory."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when mac80211 processes attacker-supplied 802.11 data frames received over WiFi in a mesh deployment; per kernel CNA guidance, WiFi frame delivery is Adjacent rather than fully remote Network.\nAC:L - Once on a mesh network as an authorized peer, an attacker can reliably trigger the no-route unicast forward path by sending frames to destinations without an active mesh path, causing deterministic skb free followed by the UAF read.\nPR:N - Exploitation requires no privileges on the victim host; the attacker only needs to transmit valid mesh data frames from an adjacent peer, not local root, capabilities, or namespace admin rights on the target system.\nUI:N - No victim user action is required beyond normal mesh operation; the bug fires automatically during RX processing of the attacker\u0027s frames.\nS:U - Impact is confined to kernel/mac80211 memory on the receiving system and does not cross a VM, container, or IOMMU security boundary.\nC:H - The flaw is a slab use-after-free read of skb-\u003ecb via sta_stats_encode_rate(), which can expose freed heap contents and is classified as high confidentiality impact for UAF bugs.\nI:H - Use-after-free of skb control-block memory provides a standard heap corruption primitive that can be developed into arbitrary kernel writes or code execution, not merely a benign stats miscalculation.\nA:H - The freed-skb path produces KASAN-reported slab use-after-free and can cause kernel oops or panic; the condition is repeatable by sending additional triggering frames for denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:26.505Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07"
},
{
"url": "https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349"
}
],
"title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64117",
"datePublished": "2026-07-19T15:40:16.941Z",
"dateReserved": "2026-07-19T07:54:57.035Z",
"dateUpdated": "2026-08-05T12:39:26.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68294 (GCVE-0-2026-68294)
Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-19 16:32
VLAI
EPSS
VEX
Title
net: qrtr: restrict socket creation to the initial network namespace
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: restrict socket creation to the initial network namespace
QRTR keeps its entire port and node state in module-global variables
that are not partitioned per network namespace: qrtr_local_nid is a
single global node id (always 1) and qrtr_ports is a single global
xarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that
global state with no network-namespace check, and qrtr_create() places
no restriction on the namespace a socket is created in.
As a result an unprivileged process that creates an AF_QIPCRTR socket
in a separate network namespace, e.g. via
unshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -
including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR
sockets owned by another namespace, and vice versa. The receiving
socket sees such a message as coming from node id 1, indistinguishable
from a legitimate local client, breaking the isolation that network
namespaces are expected to provide.
QRTR is a transport to global hardware endpoints (the modem and other
remote processors) and has no per-namespace semantics; its in-kernel
name service already creates its socket in init_net only. Confine the
socket family to the initial network namespace, as other
non-namespace-aware socket families do (see llc_ui_create() and the
ieee802154 socket code).
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/7814f6a3415cad38a… | |
| https://git.kernel.org/stable/c/2d22b94a154ccb975… | |
| https://git.kernel.org/stable/c/8d351fe0654a20c9f… | |
| https://git.kernel.org/stable/c/4b95e1f0d6e6342c4… | |
| https://git.kernel.org/stable/c/f488116df769bdaf8… | |
| https://git.kernel.org/stable/c/8150c48fb978e0168… | |
| https://git.kernel.org/stable/c/659b9b4f194bb56b9… | |
| https://git.kernel.org/stable/c/3b536db8fb32da9e9… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 7814f6a3415cad38aa8d6dfc573df778260d66aa
(git)
Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 2d22b94a154ccb9755dddfff802fe3e2b1adbab5 (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 4b95e1f0d6e6342c427cb341ee18a894b146b789 (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < f488116df769bdaf89c93371350e49e12133e70f (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 8150c48fb978e01689f94ed80148f8a7499ae571 (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 659b9b4f194bb56b9903cc95e786ef1d438baa7d (git) Affected: bdabad3e363d825ddf9679dd431cca0b2c30f881 , < 3b536db8fb32da9e9c62f2bb45e2e319331f0426 (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/qrtr/af_qrtr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7814f6a3415cad38aa8d6dfc573df778260d66aa",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "2d22b94a154ccb9755dddfff802fe3e2b1adbab5",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "4b95e1f0d6e6342c427cb341ee18a894b146b789",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "f488116df769bdaf89c93371350e49e12133e70f",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "8150c48fb978e01689f94ed80148f8a7499ae571",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "659b9b4f194bb56b9903cc95e786ef1d438baa7d",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
},
{
"lessThan": "3b536db8fb32da9e9c62f2bb45e2e319331f0426",
"status": "affected",
"version": "bdabad3e363d825ddf9679dd431cca0b2c30f881",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/qrtr/af_qrtr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: restrict socket creation to the initial network namespace\n\nQRTR keeps its entire port and node state in module-global variables\nthat are not partitioned per network namespace: qrtr_local_nid is a\nsingle global node id (always 1) and qrtr_ports is a single global\nxarray. qrtr_port_lookup() and qrtr_local_enqueue() operate on that\nglobal state with no network-namespace check, and qrtr_create() places\nno restriction on the namespace a socket is created in.\n\nAs a result an unprivileged process that creates an AF_QIPCRTR socket\nin a separate network namespace, e.g. via\nunshare(CLONE_NEWUSER | CLONE_NEWNET), can send QRTR datagrams -\nincluding control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR\nsockets owned by another namespace, and vice versa. The receiving\nsocket sees such a message as coming from node id 1, indistinguishable\nfrom a legitimate local client, breaking the isolation that network\nnamespaces are expected to provide.\n\nQRTR is a transport to global hardware endpoints (the modem and other\nremote processors) and has no per-namespace semantics; its in-kernel\nname service already creates its socket in init_net only. Confine the\nsocket family to the initial network namespace, as other\nnon-namespace-aware socket families do (see llc_ui_create() and the\nieee802154 socket code)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access to issue socket()/sendmsg() syscalls on an AF_QIPCRTR socket from within a network namespace on the target system; there is no remote packet path into qrtr_create().\nAC:L - The attack is fully deterministic: unshare(CLONE_NEWUSER|CLONE_NEWNET), create an AF_QIPCRTR socket (module autoloads via net-pf-42), and sendmsg() to node 1. No race, no memory-layout dependency, no victim state required.\nPR:L - Any unprivileged local user can create the required network namespace via unshare(CLONE_NEWUSER|CLONE_NEWNET), and a containerized process is already in one; the CAP_NET_ADMIN check at qrtr_port_assign() only gates low/control ports and is not needed for this attack.\nUI:N - The attacker performs all steps itself; no action by any other user or administrator is required to trigger the cross-namespace delivery.\nS:C - The flaw defeats the network-namespace confinement boundary itself: a process sandboxed in its own netns reaches the init_net global QRTR control plane, the in-kernel name service, and host-owned sockets, impacting resources under a different security authority than the attacker\u0027s container.\nC:H - By spoofing QRTR_TYPE_NEW_SERVER to the name service, a confined attacker registers itself as a well-known service so legitimate host clients direct their QMI traffic to it, and it can address modem/remote-processor endpoints directly, exposing sensitive telephony data it was isolated from.\nI:H - The attacker can inject arbitrary control-plane messages (NEW_SERVER, DEL_SERVER, BYE, DEL_CLIENT) that the receiver cannot distinguish from a legitimate node-1 client, corrupting the global service registry and allowing forged replies to host clients and commands to the modem.\nA:H - A single spoofed QRTR_TYPE_BYE makes ctrl_cmd_bye() delete every server registered on the local node and broadcast their removal, and the QRTR_NS_MAX_SERVERS/MAX_LOOKUPS limits can be exhausted, causing complete and repeatable loss of QRTR/modem IPC service for the whole system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:32:43.629Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7814f6a3415cad38aa8d6dfc573df778260d66aa"
},
{
"url": "https://git.kernel.org/stable/c/2d22b94a154ccb9755dddfff802fe3e2b1adbab5"
},
{
"url": "https://git.kernel.org/stable/c/8d351fe0654a20c9f95a61b05d24ebe6d4be3fbb"
},
{
"url": "https://git.kernel.org/stable/c/4b95e1f0d6e6342c427cb341ee18a894b146b789"
},
{
"url": "https://git.kernel.org/stable/c/f488116df769bdaf89c93371350e49e12133e70f"
},
{
"url": "https://git.kernel.org/stable/c/8150c48fb978e01689f94ed80148f8a7499ae571"
},
{
"url": "https://git.kernel.org/stable/c/659b9b4f194bb56b9903cc95e786ef1d438baa7d"
},
{
"url": "https://git.kernel.org/stable/c/3b536db8fb32da9e9c62f2bb45e2e319331f0426"
}
],
"title": "net: qrtr: restrict socket creation to the initial network namespace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68294",
"datePublished": "2026-08-10T12:02:27.423Z",
"dateReserved": "2026-07-30T09:28:09.380Z",
"dateUpdated": "2026-08-19T16:32:43.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68363 (GCVE-0-2026-68363)
Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-19 16:34
VLAI
EPSS
VEX
Title
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via
request_firmware_nowait(), passing hif_dev as the completion context, and
then still dereferences hif_dev:
dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n",
hif_dev->fw_name);
The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events"
workqueue and, when the firmware is missing, walks the retry chain into
ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That
releases the wait_for_completion(&hif_dev->fw_done) in a concurrent
ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing
dev_info() in the frame that re-armed the request can therefore read freed
memory (hif_dev->udev, the first field of struct hif_device_usb):
BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware
Read of size 8 ... by task kworker/...
ath9k_hif_request_firmware
ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247
request_firmware_work_func
Allocated by ...:
ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c
Freed by ...:
ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c
The fw_done barrier only makes disconnect wait for the firmware chain to
*terminate*; it does not protect the outer ath9k_hif_request_firmware()
frame that re-armed the request and keeps touching hif_dev afterwards.
Drop the post-request dev_info(): it is the only use of hif_dev after the
async request is armed, and it is purely informational (the dev_err() on the
failure path runs only when request_firmware_nowait() did not arm a callback,
so hif_dev is still alive there).
This was first reported by syzbot as a single, non-reproduced crash that was
later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer,
which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc
device whose firmware download fails). The vulnerable code is unchanged and
still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN
once the (sub-microsecond) race window is widened.
Severity
No CVSS data available.
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/47ed81aaa7f94d980… | |
| https://git.kernel.org/stable/c/48de0c6952192b077… | |
| https://git.kernel.org/stable/c/063497cc9f320ab71… | |
| https://git.kernel.org/stable/c/7f184ca38a90889f3… | |
| https://git.kernel.org/stable/c/10b0ce629123a3737… | |
| https://git.kernel.org/stable/c/48a69cedde7388294… | |
| https://git.kernel.org/stable/c/7c9046d92c4b9789c… | |
| https://git.kernel.org/stable/c/dad9f96945d77ecd4… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 47ed81aaa7f94d9808f4719e78a760c2ec1e6c86
(git)
Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 48de0c6952192b0771fca468df4364d11ec74ad9 (git) Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 063497cc9f320ab71a7a937c3bc0a23e630aefe2 (git) Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 7f184ca38a90889f3f6665ff96748b95da39dbee (git) Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 10b0ce629123a3737b4eda50188f73bb7be7b68b (git) Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 48a69cedde7388294e4ea6fd804156cd62bc04fc (git) Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < 7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a (git) Affected: e904cf6fe23022cde4e0ea9d41601411a315a3dc , < dad9f96945d77ecd4708f730c06ef54dcd8cc057 (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath9k/hif_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47ed81aaa7f94d9808f4719e78a760c2ec1e6c86",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "48de0c6952192b0771fca468df4364d11ec74ad9",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "063497cc9f320ab71a7a937c3bc0a23e630aefe2",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "7f184ca38a90889f3f6665ff96748b95da39dbee",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "10b0ce629123a3737b4eda50188f73bb7be7b68b",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "48a69cedde7388294e4ea6fd804156cd62bc04fc",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "dad9f96945d77ecd4708f730c06ef54dcd8cc057",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath9k/hif_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: don\u0027t dereference hif_dev after re-arming firmware request\n\nath9k_hif_request_firmware() re-arms an asynchronous firmware load via\nrequest_firmware_nowait(), passing hif_dev as the completion context, and\nthen still dereferences hif_dev:\n\n\tdev_info(\u0026hif_dev-\u003eudev-\u003edev, \"ath9k_htc: Firmware %s requested\\n\",\n\t\t hif_dev-\u003efw_name);\n\nThe re-armed callback ath9k_hif_usb_firmware_cb() runs on the \"events\"\nworkqueue and, when the firmware is missing, walks the retry chain into\nath9k_hif_usb_firmware_fail() -\u003e complete_all(\u0026hif_dev-\u003efw_done). That\nreleases the wait_for_completion(\u0026hif_dev-\u003efw_done) in a concurrent\nath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing\ndev_info() in the frame that re-armed the request can therefore read freed\nmemory (hif_dev-\u003eudev, the first field of struct hif_device_usb):\n\n BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware\n Read of size 8 ... by task kworker/...\n ath9k_hif_request_firmware\n ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247\n request_firmware_work_func\n Allocated by ...:\n ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c\n Freed by ...:\n ath9k_hif_usb_disconnect -\u003e kfree drivers/net/wireless/ath/ath9k/hif_usb.c\n\nThe fw_done barrier only makes disconnect wait for the firmware chain to\n*terminate*; it does not protect the outer ath9k_hif_request_firmware()\nframe that re-armed the request and keeps touching hif_dev afterwards.\n\nDrop the post-request dev_info(): it is the only use of hif_dev after the\nasync request is armed, and it is purely informational (the dev_err() on the\nfailure path runs only when request_firmware_nowait() did not arm a callback,\nso hif_dev is still alive there).\n\nThis was first reported by syzbot as a single, non-reproduced crash that was\nlater auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer,\nwhich produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc\ndevice whose firmware download fails). The vulnerable code is unchanged and\nstill present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN\nonce the (sub-microsecond) race window is widened."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:18.694Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47ed81aaa7f94d9808f4719e78a760c2ec1e6c86"
},
{
"url": "https://git.kernel.org/stable/c/48de0c6952192b0771fca468df4364d11ec74ad9"
},
{
"url": "https://git.kernel.org/stable/c/063497cc9f320ab71a7a937c3bc0a23e630aefe2"
},
{
"url": "https://git.kernel.org/stable/c/7f184ca38a90889f3f6665ff96748b95da39dbee"
},
{
"url": "https://git.kernel.org/stable/c/10b0ce629123a3737b4eda50188f73bb7be7b68b"
},
{
"url": "https://git.kernel.org/stable/c/48a69cedde7388294e4ea6fd804156cd62bc04fc"
},
{
"url": "https://git.kernel.org/stable/c/7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a"
},
{
"url": "https://git.kernel.org/stable/c/dad9f96945d77ecd4708f730c06ef54dcd8cc057"
}
],
"title": "wifi: ath9k: hif_usb: don\u0027t dereference hif_dev after re-arming firmware request",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68363",
"datePublished": "2026-08-10T12:03:40.355Z",
"dateReserved": "2026-07-30T09:28:09.385Z",
"dateUpdated": "2026-08-19T16:34:18.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…