Action not permitted
Modal body text goes here.
Modal Title
Modal Body
alsa-2026:68532
Vulnerability from osv_almalinux
Published
2026-09-17 00:00
Modified
2026-09-17 09:41
Summary
Important: kernel-rt security update
Details
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
- kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
- kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
- kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
- kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
- kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
- kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
- kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
- kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
- kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
- kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
- kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
- kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
- kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
- kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
- kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
- kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
- kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
- kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
- kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
- kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
- kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
- kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
- kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. \n\nSecurity Fix(es): \n\n * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)\n * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)\n * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)\n * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)\n * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)\n * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n * kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)\n * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)\n * kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:68532",
"modified": "2026-09-17T09:41:11Z",
"published": "2026-09-17T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:68532"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-23103"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-31663"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-43233"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-43339"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-46266"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-46306"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-52920"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53075"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53131"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53176"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53192"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53223"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53228"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53239"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53268"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53275"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63917"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63919"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63921"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-64002"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68143"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68426"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-72298"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2436771"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2461462"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2467135"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468102"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2484456"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2486463"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492112"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492295"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492733"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492741"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492747"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492770"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492779"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492811"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492841"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502363"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502368"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502412"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502434"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2513218"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2513477"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2516599"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-68532.html"
}
],
"related": [
"CVE-2026-23103",
"CVE-2026-31663",
"CVE-2026-43233",
"CVE-2026-43339",
"CVE-2026-46266",
"CVE-2026-46306",
"CVE-2026-52920",
"CVE-2026-53075",
"CVE-2026-53228",
"CVE-2026-53176",
"CVE-2026-53131",
"CVE-2026-53268",
"CVE-2026-53239",
"CVE-2026-53192",
"CVE-2026-53223",
"CVE-2026-53275",
"CVE-2026-64002",
"CVE-2026-63921",
"CVE-2026-63919",
"CVE-2026-63917",
"CVE-2026-68143",
"CVE-2026-68426",
"CVE-2026-72298"
],
"summary": "Important: kernel-rt security update"
}
CVE-2026-23103 (GCVE-0-2026-23103)
Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-09-08 08:44
VLAI
EPSS
VEX
Title
ipvlan: Make the addrs_lock be per port
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: Make the addrs_lock be per port
Make the addrs_lock be per port, not per ipvlan dev.
Initial code seems to be written in the assumption,
that any address change must occur under RTNL.
But it is not so for the case of IPv6. So
1) Introduce per-port addrs_lock.
2) It was needed to fix places where it was forgotten
to take lock (ipvlan_open/ipvlan_close)
This appears to be a very minor problem though.
Since it's highly unlikely that ipvlan_add_addr() will
be called on 2 CPU simultaneously. But nevertheless,
this could cause:
1) False-negative of ipvlan_addr_busy(): one interface
iterated through all port->ipvlans + ipvlan->addrs
under some ipvlan spinlock, and another added IP
under its own lock. Though this is only possible
for IPv6, since looks like only ipvlan_addr6_event() can be
called without rtnl_lock.
2) Race since ipvlan_ht_addr_add(port) is called under
different ipvlan->addrs_lock locks
This should not affect performance, since add/remove IP
is a rare situation and spinlock is not taken on fast
paths.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 20:21 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/3c149b662cbb202a4… | |
| https://git.kernel.org/stable/c/70feb16e3fbfb10b1… | |
| https://git.kernel.org/stable/c/88f83e6c9cdb46b8c… | |
| https://git.kernel.org/stable/c/04ba6de6eff61238e… | |
| https://git.kernel.org/stable/c/1f300c10d92c547c3… | |
| https://git.kernel.org/stable/c/6a81e2db096913d7e… | |
| https://git.kernel.org/stable/c/d3ba32162488283c0… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8230819494b3bf284ca7262ac5f877333147b937 , < 3c149b662cbb202a450e81f938e702ba333864ad
(git)
Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 70feb16e3fbfb10b15de1396557c38e99f1ab8df (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 88f83e6c9cdb46b8c8ddd0ba01393362963cf589 (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 04ba6de6eff61238e5397c14ac26a6578c7735a5 (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 1f300c10d92c547c3a7d978e1212ff52f18256ed (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < 6a81e2db096913d7e43aada1c350c1282e76db39 (git) Affected: 8230819494b3bf284ca7262ac5f877333147b937 , < d3ba32162488283c0a4c5bedd8817aec91748802 (git) |
|
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.249 , ≤ 5.10.* (semver) Unaffected: 5.15.199 , ≤ 5.15.* (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.6.122 , ≤ 6.6.* (semver) Unaffected: 6.12.68 , ≤ 6.12.* (semver) Unaffected: 6.18.8 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T20:21:03.730200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T20:21:13.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:44:55.724Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ipvlan/ipvlan.h",
"drivers/net/ipvlan/ipvlan_core.c",
"drivers/net/ipvlan/ipvlan_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c149b662cbb202a450e81f938e702ba333864ad",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "70feb16e3fbfb10b15de1396557c38e99f1ab8df",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "88f83e6c9cdb46b8c8ddd0ba01393362963cf589",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "04ba6de6eff61238e5397c14ac26a6578c7735a5",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "1f300c10d92c547c3a7d978e1212ff52f18256ed",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "6a81e2db096913d7e43aada1c350c1282e76db39",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
},
{
"lessThan": "d3ba32162488283c0a4c5bedd8817aec91748802",
"status": "affected",
"version": "8230819494b3bf284ca7262ac5f877333147b937",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ipvlan/ipvlan.h",
"drivers/net/ipvlan/ipvlan_core.c",
"drivers/net/ipvlan/ipvlan_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.249",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.199",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.162",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.122",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.68",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.249",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.199",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.162",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.122",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.68",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.8",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: Make the addrs_lock be per port\n\nMake the addrs_lock be per port, not per ipvlan dev.\n\nInitial code seems to be written in the assumption,\nthat any address change must occur under RTNL.\nBut it is not so for the case of IPv6. So\n\n1) Introduce per-port addrs_lock.\n\n2) It was needed to fix places where it was forgotten\nto take lock (ipvlan_open/ipvlan_close)\n\nThis appears to be a very minor problem though.\nSince it\u0027s highly unlikely that ipvlan_add_addr() will\nbe called on 2 CPU simultaneously. But nevertheless,\nthis could cause:\n\n1) False-negative of ipvlan_addr_busy(): one interface\niterated through all port-\u003eipvlans + ipvlan-\u003eaddrs\nunder some ipvlan spinlock, and another added IP\nunder its own lock. Though this is only possible\nfor IPv6, since looks like only ipvlan_addr6_event() can be\ncalled without rtnl_lock.\n\n2) Race since ipvlan_ht_addr_add(port) is called under\ndifferent ipvlan-\u003eaddrs_lock locks\n\nThis should not affect performance, since add/remove IP\nis a rare situation and spinlock is not taken on fast\npaths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Creating and managing ipvlan devices requires local access via netlink/rtnetlink syscalls. This is not remotely reachable.\nAC:L - The attacker controls both sides of the race by creating multiple ipvlan devices on the same port and triggering concurrent open/address-change operations. The race is reliably reproducible with retries.\nPR:L - ipvlan creation requires CAP_NET_ADMIN, which is obtainable via user namespaces (unshare -Urn) on a veth device. The ns_capable check on the physical device\u0027s user_ns is satisfied when both are in the user\u0027s namespace.\nUI:N - No user interaction is needed. The attacker can create ipvlan devices and trigger the race entirely on their own.\nS:U - This is a standard kernel privilege escalation vulnerability with no security boundary crossing (no VM escape, no IOMMU bypass).\nC:H - The race leads to a use-after-free in the per-port hash table used on the packet data path. The dangling pointer allows reading freed/reallocated memory contents during hash table lookups.\nI:H - The UAF in the hash table allows an attacker to reallocate the freed ipvl_addr structure with controlled data, enabling heap spraying and potential code execution through corrupted hash table entries.\nA:H - The dangling pointer in the hash table will cause a kernel crash when the freed memory is accessed during packet processing, leading to a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:20:16.355Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c149b662cbb202a450e81f938e702ba333864ad"
},
{
"url": "https://git.kernel.org/stable/c/70feb16e3fbfb10b15de1396557c38e99f1ab8df"
},
{
"url": "https://git.kernel.org/stable/c/88f83e6c9cdb46b8c8ddd0ba01393362963cf589"
},
{
"url": "https://git.kernel.org/stable/c/04ba6de6eff61238e5397c14ac26a6578c7735a5"
},
{
"url": "https://git.kernel.org/stable/c/1f300c10d92c547c3a7d978e1212ff52f18256ed"
},
{
"url": "https://git.kernel.org/stable/c/6a81e2db096913d7e43aada1c350c1282e76db39"
},
{
"url": "https://git.kernel.org/stable/c/d3ba32162488283c0a4c5bedd8817aec91748802"
}
],
"title": "ipvlan: Make the addrs_lock be per port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23103",
"datePublished": "2026-02-04T16:08:24.771Z",
"dateReserved": "2026-01-13T15:37:45.966Z",
"dateUpdated": "2026-09-08T08:44:55.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31663 (GCVE-0-2026-31663)
Vulnerability from cvelistv5 – Published: 2026-04-24 14:45 – Updated: 2026-09-17 12:04
VLAI
EPSS
VEX
Title
xfrm: hold dev ref until after transport_finish NF_HOOK
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold dev ref until after transport_finish NF_HOOK
After async crypto completes, xfrm_input_resume() calls dev_put()
immediately on re-entry before the skb reaches transport_finish.
The skb->dev pointer is then used inside NF_HOOK and its okfn,
which can race with device teardown.
Remove the dev_put from the async resumption entry and instead
drop the reference after the NF_HOOK call in transport_finish,
using a saved device pointer since NF_HOOK may consume the skb.
This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip
the okfn.
For non-transport exits (decaps, gro, drop) and secondary
async return points, release the reference inline when
async is set.
Severity
CWE
- CWE-826 - Premature Release of Resource During Expected Lifetime
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/4236c30b437b80f67… | |
| https://git.kernel.org/stable/c/0f451b43c88bf2b9c… | |
| https://git.kernel.org/stable/c/5002beda5cac69d52… | |
| https://git.kernel.org/stable/c/1c428b03840094410… | |
| https://access.redhat.com/security/cve/CVE-2026-31663 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2461462 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:67471 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:68532 | vendor-advisoryx_refsource_REDHAT |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
acf568ee859f098279eadf551612f103afdacb4e , < 4236c30b437b80f673b9e08c8fae38b8d471ac9e
(git)
Affected: acf568ee859f098279eadf551612f103afdacb4e , < 0f451b43c88bf2b9c038b414be580efee42e031b (git) Affected: acf568ee859f098279eadf551612f103afdacb4e , < 5002beda5cac69d522dc54da0d5d463ed9c963d2 (git) Affected: acf568ee859f098279eadf551612f103afdacb4e , < 1c428b03840094410c5fb6a5db30640486bbbfcb (git) Affected: 69895c5ea0ca2e8d7de1e6d36965d0ab9730787f (git) Affected: 833760100588acfb267dac4d6a02ab9931237739 (git) Affected: e095ecaec6d94aa2156cceb98a85d409b51190f3 (git) Affected: 3.2.100 , < 3.3 (semver) Affected: 3.16.55 , < 3.17 (semver) Affected: 4.14.24 , < 4.15 (semver) |
|
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.23 , ≤ 6.18.* (semver) Unaffected: 6.19.13 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:6.12.0-211.55.1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.55.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device\u0027s reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-826",
"description": "Premature Release of Resource During Expected Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:04:39.896Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-31663"
},
{
"name": "RHBZ#2461462",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67471"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68532"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:67471: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:68532: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: xfrm: hold dev ref until after transport_finish NF_HOOK",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "0f451b43c88bf2b9c038b414be580efee42e031b",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "1c428b03840094410c5fb6a5db30640486bbbfcb",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"status": "affected",
"version": "69895c5ea0ca2e8d7de1e6d36965d0ab9730787f",
"versionType": "git"
},
{
"status": "affected",
"version": "833760100588acfb267dac4d6a02ab9931237739",
"versionType": "git"
},
{
"status": "affected",
"version": "e095ecaec6d94aa2156cceb98a85d409b51190f3",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.100",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.55",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb-\u003edev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The complete attacker-controlled path requires a local unprivileged user to create a user/net namespace, configure transport-mode XFRM state, send traffic, and tear down the namespace/device in parallel.\nAC:L - The race is attacker-controlled in the user-namespace scenario: the attacker controls packet injection and device/netns teardown and can repeat the sequence reliably.\nPR:L - XFRM and rtnetlink setup require CAP_NET_ADMIN, but these checks are against the network namespace user_ns and are reachable after unshare -Urn by an unprivileged local user.\nUI:N - No victim action is required once the attacker can run local code and create the namespace setup.\nS:U - The vulnerable component and impacted resource are the kernel itself; this is a standard kernel memory-safety issue rather than a VM or hardware boundary escape.\nC:H - This is a net_device use-after-free, and freed kernel heap objects can potentially be reclaimed and abused for kernel memory disclosure.\nI:H - Use-after-free in kernel networking code can potentially be shaped into control-flow or data-structure corruption, so high integrity impact is appropriate.\nA:H - The issue was reproduced as a KASAN slab-use-after-free in the async XFRM reinject path and can crash the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:13.957Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"
},
{
"url": "https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"
},
{
"url": "https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"
},
{
"url": "https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"
}
],
"title": "xfrm: hold dev ref until after transport_finish NF_HOOK",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31663",
"datePublished": "2026-04-24T14:45:13.239Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-09-17T12:04:39.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43233 (GCVE-0-2026-43233)
Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26
VLAI
EPSS
VEX
Title
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In decode_choice(), the boundary check before get_len() uses the
variable `len`, which is still 0 from its initialization at the top of
the function:
unsigned int type, ext, len = 0;
...
if (ext || (son->attr & OPEN)) {
BYTE_ALIGN(bs);
if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */
return H323_ERROR_BOUND;
len = get_len(bs); /* OOB read */
When the bitstream is exactly consumed (bs->cur == bs->end), the check
nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),
which is false. The subsequent get_len() call then dereferences
*bs->cur++, reading 1 byte past the end of the buffer. If that byte
has bit 7 set, get_len() reads a second byte as well.
This can be triggered remotely by sending a crafted Q.931 SETUP message
with a User-User Information Element containing exactly 2 bytes of
PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with
the nf_conntrack_h323 helper active. The decoder fully consumes the
PER buffer before reaching this code path, resulting in a 1-2 byte
heap-buffer-overflow read confirmed by AddressSanitizer.
Fix this by checking for 2 bytes (the maximum that get_len() may read)
instead of the uninitialized `len`. This matches the pattern used at
every other get_len() call site in the same file, where the caller
checks for 2 bytes of available data before calling get_len().
Severity
8.2 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9… | |
| https://git.kernel.org/stable/c/2a3aac4205e7d2f1a… | |
| https://git.kernel.org/stable/c/81f2fc5b0d0cf4696… | |
| https://git.kernel.org/stable/c/7ef82863d42261817… | |
| https://git.kernel.org/stable/c/53d32735d77ab56cc… | |
| https://git.kernel.org/stable/c/f0a83d0a4b7c127d3… | |
| https://git.kernel.org/stable/c/35f1943d242e1b9f0… | |
| https://git.kernel.org/stable/c/baed0d9ba91d4f390… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041
(git)
Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a (git) Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < 81f2fc5b0d0cf4696146f00f837596d10b92dead (git) Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < 7ef82863d42261817a6394c6c881bd6757a70f16 (git) Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < 53d32735d77ab56cc3fc7bd53a7d099418f19be1 (git) Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < f0a83d0a4b7c127d32ac06d607a9214937716129 (git) Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < 35f1943d242e1b9f0b6e91c0c93bfb293a9f8224 (git) Affected: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa , < baed0d9ba91d4f390da12d5039128ee897253d60 (git) |
|
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_h323_asn1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "81f2fc5b0d0cf4696146f00f837596d10b92dead",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "7ef82863d42261817a6394c6c881bd6757a70f16",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "53d32735d77ab56cc3fc7bd53a7d099418f19be1",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "f0a83d0a4b7c127d32ac06d607a9214937716129",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "35f1943d242e1b9f0b6e91c0c93bfb293a9f8224",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "baed0d9ba91d4f390da12d5039128ee897253d60",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_h323_asn1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_choice()\n\nIn decode_choice(), the boundary check before get_len() uses the\nvariable `len`, which is still 0 from its initialization at the top of\nthe function:\n\n unsigned int type, ext, len = 0;\n ...\n if (ext || (son-\u003eattr \u0026 OPEN)) {\n BYTE_ALIGN(bs);\n if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */\n return H323_ERROR_BOUND;\n len = get_len(bs); /* OOB read */\n\nWhen the bitstream is exactly consumed (bs-\u003ecur == bs-\u003eend), the check\nnf_h323_error_boundary(bs, 0, 0) evaluates to (bs-\u003ecur + 0 \u003e bs-\u003eend),\nwhich is false. The subsequent get_len() call then dereferences\n*bs-\u003ecur++, reading 1 byte past the end of the buffer. If that byte\nhas bit 7 set, get_len() reads a second byte as well.\n\nThis can be triggered remotely by sending a crafted Q.931 SETUP message\nwith a User-User Information Element containing exactly 2 bytes of\nPER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with\nthe nf_conntrack_h323 helper active. The decoder fully consumes the\nPER buffer before reaching this code path, resulting in a 1-2 byte\nheap-buffer-overflow read confirmed by AddressSanitizer.\n\nFix this by checking for 2 bytes (the maximum that get_len() may read)\ninstead of the uninitialized `len`. This matches the pattern used at\nevery other get_len() call site in the same file, where the caller\nchecks for 2 bytes of available data before calling get_len()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable H.323 conntrack Q.931 helper processes TCP/1720 network traffic, and the fix explicitly documents remote triggering with a crafted Q.931 SETUP User-User IE through a firewall with the helper active.\nAC:L - The trigger is a deterministic malformed PER buffer of exact length; no race, heap grooming, or victim-controlled timing is required beyond the helper being active.\nPR:N - The attacker only sends network packets to a system/firewall where the H.323 helper is configured; the Q.931 parsing path has no authentication or attacker privilege check.\nUI:N - No victim user action is needed once the helper is active; packet receipt alone drives conntrack into the decoder.\nS:U - The impact remains within the kernel/network filtering security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:L - The bug performs a strictly bounded 1-2 byte out-of-bounds heap read via get_len(), so any confidentiality impact is limited rather than arbitrary memory disclosure.\nI:N - The vulnerable operation is read-only, and the subsequent bounds check returns an error; there is no out-of-bounds write or structure corruption.\nA:H - The remotely triggerable kernel heap out-of-bounds read is reachable repeatedly from packet processing and can cause sanitizer/oops/panic-style kernel failure on affected deployments."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:46.159Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041"
},
{
"url": "https://git.kernel.org/stable/c/2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a"
},
{
"url": "https://git.kernel.org/stable/c/81f2fc5b0d0cf4696146f00f837596d10b92dead"
},
{
"url": "https://git.kernel.org/stable/c/7ef82863d42261817a6394c6c881bd6757a70f16"
},
{
"url": "https://git.kernel.org/stable/c/53d32735d77ab56cc3fc7bd53a7d099418f19be1"
},
{
"url": "https://git.kernel.org/stable/c/f0a83d0a4b7c127d32ac06d607a9214937716129"
},
{
"url": "https://git.kernel.org/stable/c/35f1943d242e1b9f0b6e91c0c93bfb293a9f8224"
},
{
"url": "https://git.kernel.org/stable/c/baed0d9ba91d4f390da12d5039128ee897253d60"
}
],
"title": "netfilter: nf_conntrack_h323: fix OOB read in decode_choice()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43233",
"datePublished": "2026-05-06T11:28:29.565Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-08-05T12:26:46.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43339 (GCVE-0-2026-43339)
Vulnerability from cvelistv5 – Published: 2026-05-08 13:31 – Updated: 2026-08-05 12:27
VLAI
EPSS
VEX
Title
ipv6: prevent possible UaF in addrconf_permanent_addr()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent possible UaF in addrconf_permanent_addr()
The mentioned helper try to warn the user about an exceptional
condition, but the message is delivered too late, accessing the ipv6
after its possible deletion.
Reorder the statement to avoid the possible UaF; while at it, place the
warning outside the idev->lock as it needs no protection.
Severity
7.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/eec49a33611f20336… | |
| https://git.kernel.org/stable/c/bacc7f31085c98209… | |
| https://git.kernel.org/stable/c/7bfafa1b0cd582983… | |
| https://git.kernel.org/stable/c/7d9f2f4aabd116ca6… | |
| https://git.kernel.org/stable/c/25357b670afb5b517… | |
| https://git.kernel.org/stable/c/3cd4efb5df72843df… | |
| https://git.kernel.org/stable/c/2d88ed7fa000e19c2… | |
| https://git.kernel.org/stable/c/fd63f185979b047fb… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < eec49a33611f20336b357b3953df44f1a02049e8
(git)
Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < bacc7f31085c9820922f00bc7d79756ffa13123a (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 7bfafa1b0cd582983ebec6bb20f0a435528fe567 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 25357b670afb5b517096da783abaa5cc4bf8359e (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 3cd4efb5df72843dfac892d0b3c7a4a8bd926b65 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < 2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1 (git) Affected: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac , < fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/addrconf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eec49a33611f20336b357b3953df44f1a02049e8",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "bacc7f31085c9820922f00bc7d79756ffa13123a",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "7bfafa1b0cd582983ebec6bb20f0a435528fe567",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "25357b670afb5b517096da783abaa5cc4bf8359e",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "3cd4efb5df72843dfac892d0b3c7a4a8bd926b65",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "fd63f185979b047fb22a0dfc6bd94d0cab6a6a70",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/addrconf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UaF in addrconf_permanent_addr()\n\nThe mentioned helper try to warn the user about an exceptional\ncondition, but the message is delivered too late, accessing the ipv6\nafter its possible deletion.\n\nReorder the statement to avoid the possible UaF; while at it, place the\nwarning outside the idev-\u003elock as it needs no protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local network administration actions such as rtnetlink/sysctl-driven IPv6 address configuration and interface down/up transitions, not by remote packets.\nAC:L - A local attacker who can administer a network namespace can create the retained permanent-address state and repeatedly drive link-up restoration while inducing allocation pressure; there is no victim-controlled race required.\nPR:L - The operations require CAP_NET_ADMIN, but they are checked in the target network namespace and are reachable to an unprivileged local user via user+network namespaces on systems where those are enabled.\nUI:N - No victim user action is needed once the attacker can issue the local namespace/network configuration operations.\nS:U - The impact is within the kernel security authority; this is standard local kernel memory-safety impact rather than a cross-scope boundary such as guest-to-host escape.\nC:H - The bug dereferences a freed inet6_ifaddr and can read freed or reallocated kernel heap contents in the warning path; per the requested UAF guidance, confidentiality is High.\nI:H - Although the immediate dereference is in logging, it is a kernel heap use-after-free and the requested kernel guidance treats UAFs as potentially exploitable through heap reuse/spraying for high integrity impact.\nA:H - The freed object access can trigger a kernel fault, UAF detector report, or crash, and the local trigger can be repeated."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:20.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eec49a33611f20336b357b3953df44f1a02049e8"
},
{
"url": "https://git.kernel.org/stable/c/bacc7f31085c9820922f00bc7d79756ffa13123a"
},
{
"url": "https://git.kernel.org/stable/c/7bfafa1b0cd582983ebec6bb20f0a435528fe567"
},
{
"url": "https://git.kernel.org/stable/c/7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e"
},
{
"url": "https://git.kernel.org/stable/c/25357b670afb5b517096da783abaa5cc4bf8359e"
},
{
"url": "https://git.kernel.org/stable/c/3cd4efb5df72843dfac892d0b3c7a4a8bd926b65"
},
{
"url": "https://git.kernel.org/stable/c/2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1"
},
{
"url": "https://git.kernel.org/stable/c/fd63f185979b047fb22a0dfc6bd94d0cab6a6a70"
}
],
"title": "ipv6: prevent possible UaF in addrconf_permanent_addr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43339",
"datePublished": "2026-05-08T13:31:24.315Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-08-05T12:27:20.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46266 (GCVE-0-2026-46266)
Vulnerability from cvelistv5 – Published: 2026-06-03 15:50 – Updated: 2026-09-02 12:49
VLAI
EPSS
VEX
Title
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
Summary
In the Linux kernel, the following vulnerability has been resolved:
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
Yizhou Zhao reported that simply having one RAW socket on protocol
IPPROTO_RAW (255) was dangerous.
socket(AF_INET, SOCK_RAW, 255);
A malicious incoming ICMP packet can set the protocol field to 255
and match this socket, leading to FNHE cache changes.
inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST")
pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner
"man 7 raw" states:
A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able
to send any IP protocol that is specified in the passed header.
Receiving of all IP protocols via IPPROTO_RAW is not possible
using raw sockets.
Make sure we drop these malicious packets.
Severity
9.1 (Critical)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/47276297140ee6712… | |
| https://git.kernel.org/stable/c/db76b75ede3810e7c… | |
| https://git.kernel.org/stable/c/19e42490c89bac9a3… | |
| https://git.kernel.org/stable/c/531c1aec81bfe19d0… | |
| https://git.kernel.org/stable/c/719d3932b8f6e3348… | |
| https://git.kernel.org/stable/c/c89477ad794468673… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 47276297140ee6712646f9b19fb04fe26daedd01
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < db76b75ede3810e7cf9cfea5067d4f3e0993768b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 19e42490c89bac9a388f28179e66bebbef350f99 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 531c1aec81bfe19d00af13da5531fbb8209e4bd2 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 719d3932b8f6e3348ce2f0ac58e278301fc17575 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c89477ad79446867394360b29bb801010fc3ff22 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c",
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47276297140ee6712646f9b19fb04fe26daedd01",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "db76b75ede3810e7cf9cfea5067d4f3e0993768b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "19e42490c89bac9a388f28179e66bebbef350f99",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "531c1aec81bfe19d00af13da5531fbb8209e4bd2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "719d3932b8f6e3348ce2f0ac58e278301fc17575",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c89477ad79446867394360b29bb801010fc3ff22",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c",
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP\n\nYizhou Zhao reported that simply having one RAW socket on protocol\nIPPROTO_RAW (255) was dangerous.\n\n socket(AF_INET, SOCK_RAW, 255);\n\nA malicious incoming ICMP packet can set the protocol field to 255\nand match this socket, leading to FNHE cache changes.\n\ninner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\")\npkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner\n\n\"man 7 raw\" states:\n\n A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able\n to send any IP protocol that is specified in the passed header.\n Receiving of all IP protocols via IPPROTO_RAW is not possible\n using raw sockets.\n\nMake sure we drop these malicious packets."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a remotely sourced ICMP error (DEST_UNREACH/FRAG_NEEDED or REDIRECT) is received and processed through icmp_rcv() \u2192 icmp_unreach()/icmp_redirect() \u2192 icmp_socket_deliver(), which is standard internet-facing IPv4 input on any host accepting ICMP.\nAC:L - Exploitation is a single, deterministic crafted ICMP packet (inner IP proto=255, attacker-chosen daddr/PMTU) matching an open IPPROTO_RAW socket; an attacker can reliably create that socket via CAP_NET_RAW in a user+network namespace (unshare -Urn) without winning a race.\nPR:N - The network trigger requires no authentication or victim credentials\u2014only delivery of forged ICMP to the target IP; the remote attacker does not need local privileges even though a local IPPROTO_RAW socket must exist on the victim (typically opened by a daemon or a co-resident userns holder).\nUI:N - No victim user action is required beyond normal network operation; the attacker sends ICMP directly to the host without tricking anyone into clicking, mounting, or opening files.\nS:U - Impact is confined to the kernel IPv4 routing/FNHE cache within the same network namespace; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:N - This is a missing validation/logic bug that poisons route-cache metadata (PMTU/gateway); there is no memory read, pointer leak, or information-disclosure primitive.\nI:H - Before the fix, raw_err() unconditionally calls ipv4_sk_update_pmtu()/ipv4_sk_redirect(), letting a remote attacker inject attacker-controlled PMTU and gateway values into the system-wide FNHE exception cache for arbitrary destination addresses, altering forwarding for all local traffic to those destinations.\nA:H - Repeated forged ICMP FRAG_NEEDED packets can persistently force minimum PMTU entries in FNHE for chosen destinations, causing severe throughput collapse and connectivity failure for affected flows across the entire host or shared network namespace."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:49:33.535Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47276297140ee6712646f9b19fb04fe26daedd01"
},
{
"url": "https://git.kernel.org/stable/c/db76b75ede3810e7cf9cfea5067d4f3e0993768b"
},
{
"url": "https://git.kernel.org/stable/c/19e42490c89bac9a388f28179e66bebbef350f99"
},
{
"url": "https://git.kernel.org/stable/c/531c1aec81bfe19d00af13da5531fbb8209e4bd2"
},
{
"url": "https://git.kernel.org/stable/c/719d3932b8f6e3348ce2f0ac58e278301fc17575"
},
{
"url": "https://git.kernel.org/stable/c/c89477ad79446867394360b29bb801010fc3ff22"
}
],
"title": "inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46266",
"datePublished": "2026-06-03T15:50:07.907Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-09-02T12:49:33.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46306 (GCVE-0-2026-46306)
Vulnerability from cvelistv5 – Published: 2026-06-08 15:46 – Updated: 2026-09-08 08:49
VLAI
EPSS
VEX
Title
flow_dissector: do not dissect PPPoE PFC frames
Summary
In the Linux kernel, the following vulnerability has been resolved:
flow_dissector: do not dissect PPPoE PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the flow dissector driver has assumed an
uncompressed frame until the blamed commit.
During the review process of that commit [1], support for PFC is
suggested. However, having a compressed (1-byte) protocol field means
the subsequent PPP payload is shifted by one byte, causing 4-byte
misalignment for the network header and an unaligned access exception
on some architectures.
The exception can be reproduced by sending a PPPoE PFC frame to an
ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE
session is active on that interface:
$ 0 : 00000000 80c40000 00000000 85144817
$ 4 : 00000008 00000100 80a75758 81dc9bb8
$ 8 : 00000010 8087ae2c 0000003d 00000000
$12 : 000000e0 00000039 00000000 00000000
$16 : 85043240 80a75758 81dc9bb8 00006488
$20 : 0000002f 00000007 85144810 80a70000
$24 : 81d1bda0 00000000
$28 : 81dc8000 81dc9aa8 00000000 805ead08
Hi : 00009d51
Lo : 2163358a
epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50
ra : 805ead08 __skb_get_hash_net+0x74/0x12c
Status: 11000403 KERNEL EXL IE
Cause : 40800010 (ExcCode 04)
BadVA : 85144817
PrId : 0001992f (MIPS 1004Kc)
Call Trace:
[<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50
[<805ead08>] __skb_get_hash_net+0x74/0x12c
[<805ef330>] get_rps_cpu+0x1b8/0x3fc
[<805fca70>] netif_receive_skb_list_internal+0x324/0x364
[<805fd120>] napi_complete_done+0x68/0x2a4
[<8058de5c>] mtk_napi_rx+0x228/0xfec
[<805fd398>] __napi_poll+0x3c/0x1c4
[<805fd754>] napi_threaded_poll_loop+0x234/0x29c
[<805fd848>] napi_threaded_poll+0x8c/0xb0
[<80053544>] kthread+0x104/0x12c
[<80002bd8>] ret_from_kernel_thread+0x14/0x1c
Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000
To reduce the attack surface and maintain performance, do not process
PPPoE PFC frames.
[1] https://lore.kernel.org/r/20220630231016.GA392@debian.home
Severity
7.5 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/e7c811ca372d53c2b… | |
| https://git.kernel.org/stable/c/abc5bc84e0f2edc7e… | |
| https://git.kernel.org/stable/c/18ae9eacfc95cc715… | |
| https://git.kernel.org/stable/c/db104b0d8a7856397… | |
| https://git.kernel.org/stable/c/6044392d9cace3a36… | |
| https://git.kernel.org/stable/c/0d00b901506971294… | |
| https://git.kernel.org/stable/c/7c93f353eab4ea911… | |
| https://git.kernel.org/stable/c/d6c19b31a3c1d519f… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
10f665b52a75df6eb26ddebbbc072ee264183731 , < e7c811ca372d53c2be7d01a1614e71fae1054836
(git)
Affected: d7e541e86122d21f71eb71c5dfa7fb1eb6623fe8 , < abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < db104b0d8a7856397c0469d83a4289adf7c54863 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 6044392d9cace3a3672b02c8bc7d38b502e51734 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 0d00b9015069712944934bab09eaa6c542143049 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < 7c93f353eab4ea911e394630f07d72e040a729d8 (git) Affected: 46126db9c86110e5fc1e369b9bb89735ddefdae4 , < d6c19b31a3c1d519fabdcf0aa239e6b6109b9473 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:49:29.408Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/flow_dissector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7c811ca372d53c2be7d01a1614e71fae1054836",
"status": "affected",
"version": "10f665b52a75df6eb26ddebbbc072ee264183731",
"versionType": "git"
},
{
"lessThan": "abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200",
"status": "affected",
"version": "d7e541e86122d21f71eb71c5dfa7fb1eb6623fe8",
"versionType": "git"
},
{
"lessThan": "18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3",
"status": "affected",
"version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
"versionType": "git"
},
{
"lessThan": "db104b0d8a7856397c0469d83a4289adf7c54863",
"status": "affected",
"version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
"versionType": "git"
},
{
"lessThan": "6044392d9cace3a3672b02c8bc7d38b502e51734",
"status": "affected",
"version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
"versionType": "git"
},
{
"lessThan": "0d00b9015069712944934bab09eaa6c542143049",
"status": "affected",
"version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
"versionType": "git"
},
{
"lessThan": "7c93f353eab4ea911e394630f07d72e040a729d8",
"status": "affected",
"version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
"versionType": "git"
},
{
"lessThan": "d6c19b31a3c1d519fabdcf0aa239e6b6109b9473",
"status": "affected",
"version": "46126db9c86110e5fc1e369b9bb89735ddefdae4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/flow_dissector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nflow_dissector: do not dissect PPPoE PFC frames\n\nRFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT\nRECOMMENDED for PPPoE. In practice, pppd does not support negotiating\nPFC for PPPoE sessions, and the flow dissector driver has assumed an\nuncompressed frame until the blamed commit.\n\nDuring the review process of that commit [1], support for PFC is\nsuggested. However, having a compressed (1-byte) protocol field means\nthe subsequent PPP payload is shifted by one byte, causing 4-byte\nmisalignment for the network header and an unaligned access exception\non some architectures.\n\nThe exception can be reproduced by sending a PPPoE PFC frame to an\nethernet interface of a MIPS board, with RPS enabled, even if no PPPoE\nsession is active on that interface:\n\n$ 0 : 00000000 80c40000 00000000 85144817\n$ 4 : 00000008 00000100 80a75758 81dc9bb8\n$ 8 : 00000010 8087ae2c 0000003d 00000000\n$12 : 000000e0 00000039 00000000 00000000\n$16 : 85043240 80a75758 81dc9bb8 00006488\n$20 : 0000002f 00000007 85144810 80a70000\n$24 : 81d1bda0 00000000\n$28 : 81dc8000 81dc9aa8 00000000 805ead08\nHi : 00009d51\nLo : 2163358a\nepc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50\nra : 805ead08 __skb_get_hash_net+0x74/0x12c\nStatus: 11000403 KERNEL EXL IE\nCause : 40800010 (ExcCode 04)\nBadVA : 85144817\nPrId : 0001992f (MIPS 1004Kc)\nCall Trace:\n[\u003c805e91f0\u003e] __skb_flow_dissect+0x1b0/0x1b50\n[\u003c805ead08\u003e] __skb_get_hash_net+0x74/0x12c\n[\u003c805ef330\u003e] get_rps_cpu+0x1b8/0x3fc\n[\u003c805fca70\u003e] netif_receive_skb_list_internal+0x324/0x364\n[\u003c805fd120\u003e] napi_complete_done+0x68/0x2a4\n[\u003c8058de5c\u003e] mtk_napi_rx+0x228/0xfec\n[\u003c805fd398\u003e] __napi_poll+0x3c/0x1c4\n[\u003c805fd754\u003e] napi_threaded_poll_loop+0x234/0x29c\n[\u003c805fd848\u003e] napi_threaded_poll+0x8c/0xb0\n[\u003c80053544\u003e] kthread+0x104/0x12c\n[\u003c80002bd8\u003e] ret_from_kernel_thread+0x14/0x1c\n\nCode: 02d51821 1060045b 00000000 \u003c8c640000\u003e 3084000f 2c820005 144001a2 00042080 8e220000\n\nTo reduce the attack surface and maintain performance, do not process\nPPPoE PFC frames.\n\n[1] https://lore.kernel.org/r/20220630231016.GA392@debian.home"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is triggered by a crafted PPPoE session Ethernet frame received on a network interface and processed in the core packet-receive path (NAPI \u2192 `netif_receive_skb_list_internal` \u2192 `get_rps_cpu` \u2192 `__skb_get_hash_net` \u2192 `__skb_flow_dissect`), which matches kernel guidance for net-stack bugs reachable via received packets.\nAC:L - An attacker fully controls the malicious PPPoE PFC frame contents; once RPS (or another flow-hash caller such as tc flower ingress) is active on the target interface, sending the frame reliably reproduces the misaligned IPv4 header access and kernel exception without races or victim-specific timing.\nPR:N - Exploitation requires only the ability to transmit Ethernet frames to the victim interface; no local account, capabilities, or PPPoE session establishment is needed, as confirmed by the fix commit reproducing the crash with no active PPPoE session.\nUI:N - No victim user action is required beyond normal network operation; the kernel processes the injected frame automatically during receive-side RPS flow hashing.\nS:U - Impact is confined to kernel crash/DoS on the affected host; there is no cross-boundary escape from a sandbox, VM guest, or separate security authority.\nC:N - The bug causes an unaligned load fault while parsing attacker-supplied skb data at a wrong offset; it does not perform an out-of-bounds read of kernel memory or disclose kernel secrets, only misreads bytes within the crafted packet before faulting.\nI:N - There is no memory corruption, arbitrary write, or type confusion; the failure mode is a load-address exception on strict-alignment architectures (e.g., MIPS) without modifying kernel or application data.\nA:H - The documented impact is a kernel exception/oops in `__skb_flow_dissect` (MIPS ExcCode 04 unaligned access), which crashes or panics the system and can be retriggered remotely by resending the malicious frame."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:08.733Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7c811ca372d53c2be7d01a1614e71fae1054836"
},
{
"url": "https://git.kernel.org/stable/c/abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200"
},
{
"url": "https://git.kernel.org/stable/c/18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3"
},
{
"url": "https://git.kernel.org/stable/c/db104b0d8a7856397c0469d83a4289adf7c54863"
},
{
"url": "https://git.kernel.org/stable/c/6044392d9cace3a3672b02c8bc7d38b502e51734"
},
{
"url": "https://git.kernel.org/stable/c/0d00b9015069712944934bab09eaa6c542143049"
},
{
"url": "https://git.kernel.org/stable/c/7c93f353eab4ea911e394630f07d72e040a729d8"
},
{
"url": "https://git.kernel.org/stable/c/d6c19b31a3c1d519fabdcf0aa239e6b6109b9473"
}
],
"title": "flow_dissector: do not dissect PPPoE PFC frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46306",
"datePublished": "2026-06-08T15:46:33.936Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-09-08T08:49:29.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52920 (GCVE-0-2026-52920)
Vulnerability from cvelistv5 – Published: 2026-06-24 07:14 – Updated: 2026-08-05 12:31
VLAI
EPSS
VEX
Title
netfilter: xt_policy: fix strict mode inbound policy matching
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_policy: fix strict mode inbound policy matching
match_policy_in() walks sec_path entries from the last transform to the
first one, but strict policy matching needs to consume info->pol[] in
the same forward order as the rule layout.
Derive the strict-match policy position from the number of transforms
already consumed so that multi-element inbound rules are matched
consistently.
Severity
8.3 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/eb323f7b82d2e2f63… | |
| https://git.kernel.org/stable/c/fc1c518bb1f054831… | |
| https://git.kernel.org/stable/c/f98b7f85e04b40e28… | |
| https://git.kernel.org/stable/c/82664d0f1ba25e4f9… | |
| https://git.kernel.org/stable/c/b130a6eefa02bd4d4… | |
| https://git.kernel.org/stable/c/938867e870fb5471b… | |
| https://git.kernel.org/stable/c/392cc1d8408b56652… | |
| https://git.kernel.org/stable/c/4b2b4d7d4e203c92d… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < eb323f7b82d2e2f638de0cc2a177803eb20e0707
(git)
Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < fc1c518bb1f054831ecabb32da9b8e1dff9699c6 (git) Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < f98b7f85e04b40e28b08c461ded0cc79f14f5509 (git) Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < 82664d0f1ba25e4f9a71994954abae24c60f4067 (git) Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9 (git) Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < 938867e870fb5471bb16f442aeac81326e05bf65 (git) Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < 392cc1d8408b5665215c1e9290bbf0f92339b043 (git) Affected: c4b885139203d37f76662c37ae645fe8e0f4e4e5 , < 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29 (git) |
|
| Linux | Linux |
Affected:
2.6.17
Unaffected: 0 , < 2.6.17 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb323f7b82d2e2f638de0cc2a177803eb20e0707",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "fc1c518bb1f054831ecabb32da9b8e1dff9699c6",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "f98b7f85e04b40e28b08c461ded0cc79f14f5509",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "82664d0f1ba25e4f9a71994954abae24c60f4067",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "938867e870fb5471bb16f442aeac81326e05bf65",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "392cc1d8408b5665215c1e9290bbf0f92339b043",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "4b2b4d7d4e203c92db8966b163edfacb1f0e1e29",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.17"
},
{
"lessThan": "2.6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info-\u003epol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable matcher is executed while processing inbound IPv4/IPv6 packets through x_tables after XFRM/IPsec has populated the packet sec_path. A remote IPsec peer can trigger the affected strict inbound policy rule by sending network packets in a realistic VPN/gateway deployment.\nAC:L - Exploitation requires a strict inbound xt_policy rule with multiple policy elements and a packet with the same number of transforms, but those are normal affected configurations rather than attacker-uncontrolled races. Once present, triggering is repeatable by sending matching packets.\nPR:L - Unauthenticated packets generally fail XFRM state/authentication before reaching this sec_path-based match, so the network scenario requires an authorized IPsec peer or equivalent low privilege. Locally, the rule/XFRM setup is gated by CAP_NET_ADMIN in the network namespace, which is reachable through user namespaces.\nUI:N - No victim user action is needed after the vulnerable rule/state configuration exists. Packet delivery or local namespace traffic is sufficient to invoke the matcher.\nS:U - The bug is in kernel netfilter/XFRM policy evaluation and impacts the same kernel/network security authority. It does not cross a VM, IOMMU, or separate sandbox security scope.\nC:H - The old strict inbound index calculation can make pos negative and read before info-\u003epol[], including x_tables rule metadata or adjacent kernel allocation contents. Although exposed through match behavior rather than a direct copy_to_user, this is an out-of-bounds kernel read larger than a few bytes, so the higher confidentiality impact is warranted.\nI:L - The bug does not provide a direct write primitive or code execution path, but it can make strict IPsec policy matching produce incorrect firewall decisions. That can bypass or misapply intended packet filtering for affected multi-element inbound rules.\nA:H - The negative-index read can reach outside the intended match data and, for larger strict transform counts or unlucky layout, may fault/oops in kernel packet processing. The condition can be triggered repeatedly with packets once the affected rule path is reachable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:42.384Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707"
},
{
"url": "https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6"
},
{
"url": "https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509"
},
{
"url": "https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067"
},
{
"url": "https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9"
},
{
"url": "https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65"
},
{
"url": "https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043"
},
{
"url": "https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29"
}
],
"title": "netfilter: xt_policy: fix strict mode inbound policy matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52920",
"datePublished": "2026-06-24T07:14:15.866Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:42.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53075 (GCVE-0-2026-53075)
Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33
VLAI
EPSS
VEX
Title
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
Summary
In the Linux kernel, the following vulnerability has been resolved:
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
/dev/ppp open is currently authorized against file->f_cred->user_ns,
while unattached administrative ioctls operate on current->nsproxy->net_ns.
As a result, a local unprivileged user can create a new user namespace
with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,
and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against
an inherited network namespace.
Require CAP_NET_ADMIN in the user namespace that owns the target network
namespace before handling unattached PPP administrative ioctls.
This preserves normal pppd operation in the network namespace it is
actually privileged in, while rejecting the userns-only inherited-netns
case.
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/c9edd90c57ae23692… | |
| https://git.kernel.org/stable/c/5080e188c91411003… | |
| https://git.kernel.org/stable/c/67e901e28d177ac9a… | |
| https://git.kernel.org/stable/c/954745d0223e7caec… | |
| https://git.kernel.org/stable/c/3b2c2157dc2afc5c1… | |
| https://git.kernel.org/stable/c/5013be175c7ffd8b3… | |
| https://git.kernel.org/stable/c/1a8a51ce85075a56a… | |
| https://git.kernel.org/stable/c/2bb6379416fd19f44… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
273ec51dd7ceaa76e038875d85061ec856d8905e , < c9edd90c57ae23692fff6b049fdfa4572a9fd532
(git)
Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 5080e188c914110034bbc569d5cfa2f06204681d (git) Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 67e901e28d177ac9a9bed76d69ce3471e704a89e (git) Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 954745d0223e7caec917c0b2d1a889ff56fa6e54 (git) Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 3b2c2157dc2afc5c17cd7238afefca92f1ef330e (git) Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 5013be175c7ffd8b39efbc3c9c4db5b10b85fea8 (git) Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 1a8a51ce85075a56a743b6f142606dd2696a391c (git) Affected: 273ec51dd7ceaa76e038875d85061ec856d8905e , < 2bb6379416fd19f44c3423a00bfd8626259f6067 (git) |
|
| Linux | Linux |
Affected:
2.6.30
Unaffected: 0 , < 2.6.30 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9edd90c57ae23692fff6b049fdfa4572a9fd532",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "5080e188c914110034bbc569d5cfa2f06204681d",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "67e901e28d177ac9a9bed76d69ce3471e704a89e",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "954745d0223e7caec917c0b2d1a889ff56fa6e54",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "3b2c2157dc2afc5c17cd7238afefca92f1ef330e",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "5013be175c7ffd8b39efbc3c9c4db5b10b85fea8",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "1a8a51ce85075a56a743b6f142606dd2696a391c",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "2bb6379416fd19f44c3423a00bfd8626259f6067",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file-\u003ef_cred-\u003euser_ns,\nwhile unattached administrative ioctls operate on current-\u003ensproxy-\u003enet_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable PPP administrative ioctls are reached locally through `/dev/ppp` and the `ioctl` syscall, not by remote packets.\nAC:L - An attacker can deterministically create a user namespace, open `/dev/ppp`, and issue the unattached ioctls against the inherited target network namespace; no race or external condition is required.\nPR:L - A basic unprivileged local user can gain `CAP_NET_ADMIN` only inside a new user namespace and abuse the pre-fix check, so this does not require real root or host `CAP_NET_ADMIN`.\nUI:N - No victim action is required after the attacker has local code execution; the attacker directly invokes the namespace and ioctl operations.\nS:C - The bug crosses the user-namespace capability boundary by allowing capabilities in one user namespace to administer PPP resources in a network namespace owned by another user namespace.\nC:H - By attaching to existing PPP units or channels, an attacker can read PPP control/authentication traffic and can plausibly expose sensitive PPP-session data in affected deployments.\nI:H - The attacker can create PPP interfaces, attach to units/channels, alter PPP parameters, and inject or redirect PPP frames in a network namespace they should not administer.\nA:H - The attacker can disrupt PPP connectivity by changing interface/channel state, disconnecting or bridging channels, or exhausting PPP resources, causing loss of network availability in PPP-dependent systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:07.985Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532"
},
{
"url": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d"
},
{
"url": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e"
},
{
"url": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54"
},
{
"url": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e"
},
{
"url": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8"
},
{
"url": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c"
},
{
"url": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067"
}
],
"title": "ppp: require CAP_NET_ADMIN in target netns for unattached ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53075",
"datePublished": "2026-06-24T16:30:16.214Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:07.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53131 (GCVE-0-2026-53131)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-08-05 12:33
VLAI
EPSS
VEX
Title
netfilter: require Ethernet MAC header before using eth_hdr()
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: require Ethernet MAC header before using eth_hdr()
`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and
`hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`
after either assuming that the skb is associated with an Ethernet
device or checking only that the `ETH_HLEN` bytes at
`skb_mac_header(skb)` lie between `skb->head` and `skb->data`.
Make these paths first verify that the skb is associated with an
Ethernet device, that the MAC header was set, and that it spans at
least a full Ethernet header before accessing `eth_hdr(skb)`.
Severity
9.4 (Critical)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/4435888e1bf139d2b… | |
| https://git.kernel.org/stable/c/063f43361e884acd7… | |
| https://git.kernel.org/stable/c/726abf97566867f80… | |
| https://git.kernel.org/stable/c/367abcacc13a8e2e7… | |
| https://git.kernel.org/stable/c/5d634afb8b83b49de… | |
| https://git.kernel.org/stable/c/cea435ea7e868ea6f… | |
| https://git.kernel.org/stable/c/62443dc21114c0bbc… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4435888e1bf139d2bfe5911643d4217382136743
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 063f43361e884acd7300790e90194430275d0d0c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 726abf97566867f808fec9d8a408eb9698bd570a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 367abcacc13a8e2e7624408b7f593bd1e60e49d9 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5d634afb8b83b49de562792fd0d047416a43bd4d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cea435ea7e868ea6fdf039bc4f2090c1d829b556 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 62443dc21114c0bbc476fa62973db89743f2f137 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_eui64.c",
"net/netfilter/ipset/ip_set_bitmap_ipmac.c",
"net/netfilter/ipset/ip_set_hash_ipmac.c",
"net/netfilter/ipset/ip_set_hash_mac.c",
"net/netfilter/nf_log_syslog.c",
"net/netfilter/xt_mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4435888e1bf139d2bfe5911643d4217382136743",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "063f43361e884acd7300790e90194430275d0d0c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "726abf97566867f808fec9d8a408eb9698bd570a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "367abcacc13a8e2e7624408b7f593bd1e60e49d9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5d634afb8b83b49de562792fd0d047416a43bd4d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cea435ea7e868ea6fdf039bc4f2090c1d829b556",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "62443dc21114c0bbc476fa62973db89743f2f137",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_eui64.c",
"net/netfilter/ipset/ip_set_bitmap_ipmac.c",
"net/netfilter/ipset/ip_set_hash_ipmac.c",
"net/netfilter/ipset/ip_set_hash_mac.c",
"net/netfilter/nf_log_syslog.c",
"net/netfilter/xt_mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: require Ethernet MAC header before using eth_hdr()\n\n`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and\n`hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`\nafter either assuming that the skb is associated with an Ethernet\ndevice or checking only that the `ETH_HLEN` bytes at\n`skb_mac_header(skb)` lie between `skb-\u003ehead` and `skb-\u003edata`.\n\nMake these paths first verify that the skb is associated with an\nEthernet device, that the MAC header was set, and that it spans at\nleast a full Ethernet header before accessing `eth_hdr(skb)`."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:25.251Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4435888e1bf139d2bfe5911643d4217382136743"
},
{
"url": "https://git.kernel.org/stable/c/063f43361e884acd7300790e90194430275d0d0c"
},
{
"url": "https://git.kernel.org/stable/c/726abf97566867f808fec9d8a408eb9698bd570a"
},
{
"url": "https://git.kernel.org/stable/c/367abcacc13a8e2e7624408b7f593bd1e60e49d9"
},
{
"url": "https://git.kernel.org/stable/c/5d634afb8b83b49de562792fd0d047416a43bd4d"
},
{
"url": "https://git.kernel.org/stable/c/cea435ea7e868ea6fdf039bc4f2090c1d829b556"
},
{
"url": "https://git.kernel.org/stable/c/62443dc21114c0bbc476fa62973db89743f2f137"
}
],
"title": "netfilter: require Ethernet MAC header before using eth_hdr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53131",
"datePublished": "2026-06-25T08:38:20.489Z",
"dateReserved": "2026-06-09T07:44:35.386Z",
"dateUpdated": "2026-08-05T12:33:25.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53176 (GCVE-0-2026-53176)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-09-17 12:04
VLAI
EPSS
VEX
Title
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()
computes the login request payload length as wc->byte_len minus
ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.
A remote iSER initiator can post a login Send work request carrying
fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows
and login_req_len becomes negative.
isert_rx_login_req() then reads that negative length back into a signed
int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the
min() is signed it keeps the negative value; the value is then passed as
the memcpy() length and sign-extended to a multi-gigabyte size_t. The
copy into the 8192-byte login->req_buf runs far out of bounds and
faults, crashing the target node. The login phase precedes iSCSI
authentication, so no credentials are required to reach this path.
Reject any login PDU shorter than ISER_HEADERS_LEN before the
subtraction, mirroring the existing early return on a failed work
completion, so login_req_len can never go negative. The upper bound was
already safe: a posted login buffer cannot deliver more than
ISER_RX_PAYLOAD_SIZE, so the difference stays at or below
MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing
lower bound needs to be added.
Severity
9.8 (Critical)
6.5 (Medium)
CWE
- CWE-839 - Numeric Range Comparison Without Minimum Check
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/75ee6e4aa096aa9e7… | |
| https://git.kernel.org/stable/c/e8a013c0c3ca2f670… | |
| https://git.kernel.org/stable/c/bd22740d7f14cb1c0… | |
| https://git.kernel.org/stable/c/c1234229399f4af12… | |
| https://git.kernel.org/stable/c/c5584e089b5af7b3b… | |
| https://git.kernel.org/stable/c/df422fd273c96c2ee… | |
| https://git.kernel.org/stable/c/1ca40b243277c9e88… | |
| https://git.kernel.org/stable/c/29e7b925ae6df6489… | |
| https://access.redhat.com/security/cve/CVE-2026-53176 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492741 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:68532 | vendor-advisoryx_refsource_REDHAT |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b8d26b3be8b33682cf163274ed07479a70554633 , < 75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb
(git)
Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < e8a013c0c3ca2f6708341a56612a3f6d6921620a (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < bd22740d7f14cb1c0289444cfd2c8d2938667c1d (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < c1234229399f4af12c553b1b0ffd978eeba65548 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < df422fd273c96c2ee5beb80fc21adc8c70c29260 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 1ca40b243277c9e88be5e00bd3e083f71aefb93e (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 29e7b925ae6df64894e82ab6419994dc25580a8a (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Internet Small Computer System Interface (iSCSI) Extensions for Remote Direct Memory Access (RDMA) (iSER) module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow causes a negative length to be used in a memory copy operation, resulting in an out-of-bounds write that crashes the system. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-839",
"description": "Numeric Range Comparison Without Minimum Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:04:38.922Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53176"
},
{
"name": "RHBZ#2492741",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53176.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68532"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:68532: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module ib_isert from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "e8a013c0c3ca2f6708341a56612a3f6d6921620a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "bd22740d7f14cb1c0289444cfd2c8d2938667c1d",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "c1234229399f4af12c553b1b0ffd978eeba65548",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "df422fd273c96c2ee5beb80fc21adc8c70c29260",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "1ca40b243277c9e88be5e00bd3e083f71aefb93e",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "29e7b925ae6df64894e82ab6419994dc25580a8a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN\n\nIn drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()\ncomputes the login request payload length as wc-\u003ebyte_len minus\nISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.\nA remote iSER initiator can post a login Send work request carrying\nfewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows\nand login_req_len becomes negative.\n\nisert_rx_login_req() then reads that negative length back into a signed\nint, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the\nmin() is signed it keeps the negative value; the value is then passed as\nthe memcpy() length and sign-extended to a multi-gigabyte size_t. The\ncopy into the 8192-byte login-\u003ereq_buf runs far out of bounds and\nfaults, crashing the target node. The login phase precedes iSCSI\nauthentication, so no credentials are required to reach this path.\n\nReject any login PDU shorter than ISER_HEADERS_LEN before the\nsubtraction, mirroring the existing early return on a failed work\ncompletion, so login_req_len can never go negative. The upper bound was\nalready safe: a posted login buffer cannot deliver more than\nISER_RX_PAYLOAD_SIZE, so the difference stays at or below\nMAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing\nlower bound needs to be added."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached by a remote iSER initiator over an RDMA/iSER target portal using RDMA CM and posted Send login PDUs. This is network protocol input to a kernel storage target service.\nAC:L - The attacker only needs to establish an iSER connection and send a login PDU shorter than ISER_HEADERS_LEN. No race or condition outside the attacker\u0027s control is required.\nPR:N - The vulnerable memcpy occurs during iSCSI login processing before CHAP/authentication, initiator ACL checks, and normal session authorization complete. No credentials are required.\nUI:N - Exploitation is triggered solely by attacker-sent network/RDMA traffic to the exposed target portal. No victim user action is required.\nS:U - The impact is within the kernel and target host security authority. There is no VM, IOMMU, or other cross-scope boundary involved.\nC:H - The signed underflow drives an out-of-bounds kernel memcpy that reads far beyond the receive buffer. As kernel memory corruption with an out-of-bounds read component, high confidentiality impact is the higher defensible choice.\nI:H - The same oversized memcpy writes far beyond the 8192-byte login request buffer into adjacent kernel memory. This is an out-of-bounds write and may be exploitable for kernel memory corruption, so integrity impact is high.\nA:H - The commit and code path show the huge memcpy faults and crashes the iSER target node. A remote unauthenticated attacker can repeatedly trigger kernel oops/panic-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:45.742Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb"
},
{
"url": "https://git.kernel.org/stable/c/e8a013c0c3ca2f6708341a56612a3f6d6921620a"
},
{
"url": "https://git.kernel.org/stable/c/bd22740d7f14cb1c0289444cfd2c8d2938667c1d"
},
{
"url": "https://git.kernel.org/stable/c/c1234229399f4af12c553b1b0ffd978eeba65548"
},
{
"url": "https://git.kernel.org/stable/c/c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47"
},
{
"url": "https://git.kernel.org/stable/c/df422fd273c96c2ee5beb80fc21adc8c70c29260"
},
{
"url": "https://git.kernel.org/stable/c/1ca40b243277c9e88be5e00bd3e083f71aefb93e"
},
{
"url": "https://git.kernel.org/stable/c/29e7b925ae6df64894e82ab6419994dc25580a8a"
}
],
"title": "IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53176",
"datePublished": "2026-06-25T08:38:52.693Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-09-17T12:04:38.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…