Action not permitted
Modal body text goes here.
Modal Title
Modal Body
alsa-2026:68532
Vulnerability from osv_almalinux
Published
2026-09-17 00:00
Modified
2026-09-17 09:41
Summary
Important: kernel-rt security update
Details
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
- kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
- kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
- kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
- kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
- kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
- kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
- kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
- kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
- kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
- kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
- kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
- kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
- kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
- kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
- kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
- kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
- kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
- kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
- kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
- kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
- kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
- kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
- kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-debug-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-modules"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "kernel-rt-modules-extra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.18.0-553.164.1.rt7.505.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. \n\nSecurity Fix(es): \n\n * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)\n * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)\n * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)\n * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)\n * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)\n * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n * kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)\n * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)\n * kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:68532",
"modified": "2026-09-17T09:41:11Z",
"published": "2026-09-17T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:68532"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-23103"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-31663"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-43233"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-43339"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-46266"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-46306"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-52920"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53075"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53131"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53176"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53192"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53223"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53228"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53239"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53268"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-53275"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63917"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63919"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-63921"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-64002"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68143"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-68426"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-72298"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2436771"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2461462"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2467135"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468102"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2484456"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2486463"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492112"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492295"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492733"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492741"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492747"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492770"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492779"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492811"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2492841"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502363"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502368"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502412"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2502434"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2513218"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2513477"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2516599"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-68532.html"
}
],
"related": [
"CVE-2026-23103",
"CVE-2026-31663",
"CVE-2026-43233",
"CVE-2026-43339",
"CVE-2026-46266",
"CVE-2026-46306",
"CVE-2026-52920",
"CVE-2026-53075",
"CVE-2026-53228",
"CVE-2026-53176",
"CVE-2026-53131",
"CVE-2026-53268",
"CVE-2026-53239",
"CVE-2026-53192",
"CVE-2026-53223",
"CVE-2026-53275",
"CVE-2026-64002",
"CVE-2026-63921",
"CVE-2026-63919",
"CVE-2026-63917",
"CVE-2026-68143",
"CVE-2026-68426",
"CVE-2026-72298"
],
"summary": "Important: kernel-rt security update"
}
CVE-2026-53192 (GCVE-0-2026-53192)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:33
VLAI
EPSS
VEX
Title
ALSA: timer: Fix UAF at snd_timer_user_params()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Fix UAF at snd_timer_user_params()
At releasing a timer object, e.g. when a userspace timer
(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it
tries to detach the timer instances and release the resources.
However, it's still possible that other in-flight tasks are holding
the timer instance where the to-be-deleted timer object is associated,
and this may lead to racy accesses.
Fortunately, most of ioctls dealing with the timer instance list
already have the protection with register_mutex, and this also avoids
such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the
concurrent ioctl may lead to use-after-free.
This patch just adds the guard with register_mutex to protect
snd_timer_user_params() for covering the code path as a quick
workaround. It's no hot-path but rather a rarely issued ioctl, so the
performance penalty doesn't matter.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
37745918e0e7575bc40f38da93a99b9fa6406224 , < 38034d04d4a75bbca01df2b313ced0bcd0fa3242
(git)
Affected: 37745918e0e7575bc40f38da93a99b9fa6406224 , < 3d39da65b5c422c5e5afb7d5651b0698d060a827 (git) Affected: 37745918e0e7575bc40f38da93a99b9fa6406224 , < 306427adf9b97e29e5958cb9cf3096c6151fc9ff (git) Affected: 37745918e0e7575bc40f38da93a99b9fa6406224 , < 053a401b592be424fea9d57c789f66cd5d8cec11 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "38034d04d4a75bbca01df2b313ced0bcd0fa3242",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "3d39da65b5c422c5e5afb7d5651b0698d060a827",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "306427adf9b97e29e5958cb9cf3096c6151fc9ff",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "053a401b592be424fea9d57c789f66cd5d8cec11",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Fix UAF at snd_timer_user_params()\n\nAt releasing a timer object, e.g. when a userspace timer\n(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it\ntries to detach the timer instances and release the resources.\nHowever, it\u0027s still possible that other in-flight tasks are holding\nthe timer instance where the to-be-deleted timer object is associated,\nand this may lead to racy accesses.\n\nFortunately, most of ioctls dealing with the timer instance list\nalready have the protection with register_mutex, and this also avoids\nsuch races. But, SNDRV_TIMER_IOCTL_PARAMS isn\u0027t protected, hence the\nconcurrent ioctl may lead to use-after-free.\n\nThis patch just adds the guard with register_mutex to protect\nsnd_timer_user_params() for covering the code path as a quick\nworkaround. It\u0027s no hot-path but rather a rarely issued ioctl, so the\nperformance penalty doesn\u0027t matter."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local `/dev/snd/timer` ioctls, specifically `SNDRV_TIMER_IOCTL_PARAMS`, after selecting a userspace-driven ALSA timer. It is not reachable by remote network input.\nAC:L - The attacker can create the userspace-driven timer, select it, and race the params ioctl against closing the returned timer fd using their own threads or processes. No external victim state or uncontrollable timing condition is required beyond an attacker-controlled race.\nPR:L - The kernel path has no capability or admin check, but exploitation requires local access to the ALSA timer device as a basic local user. It does not require real root or init-namespace capabilities.\nUI:N - No victim action is required after the attacker has local execution and device access. The attacker can open the timer device, issue ioctls, and close fds directly.\nS:U - The impact is within the same kernel security authority. This is a standard local kernel memory corruption issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a use-after-free of a kernel timer object reachable from a user-controlled race. Kernel UAFs can be leveraged for information disclosure through heap reuse and memory manipulation.\nI:H - The stale timer pointer is subsequently dereferenced and used for locking/state decisions, making this kernel heap UAF plausibly exploitable for memory corruption and privilege escalation. Under the required overestimation rule, integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or lock freed kernel memory and crash or hang the kernel. Repeated local triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:58.587Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242"
},
{
"url": "https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827"
},
{
"url": "https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff"
},
{
"url": "https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11"
}
],
"title": "ALSA: timer: Fix UAF at snd_timer_user_params()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53192",
"datePublished": "2026-06-25T08:39:03.696Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-08-05T12:33:58.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53223 (GCVE-0-2026-53223)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50
VLAI
EPSS
VEX
Title
net: guard timestamp cmsgs to real error queue skbs
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.
Severity
7.1 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/24a0d548d3a765cd4… | |
| https://git.kernel.org/stable/c/71ff5cdd5da61d043… | |
| https://git.kernel.org/stable/c/ad9a0374ee6d11048… | |
| https://git.kernel.org/stable/c/b903e9b5629ec8dd6… | |
| https://git.kernel.org/stable/c/e0665b2a8e90bb08b… | |
| https://git.kernel.org/stable/c/3dde4fb941fa5649a… | |
| https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6… | |
| https://git.kernel.org/stable/c/1ee90b77b727df903… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8605330aac5a5785630aec8f64378a54891937cc , < 24a0d548d3a765cd4558224e4f8e06e14cba26e3
(git)
Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 71ff5cdd5da61d0438e902aa0fd68c28bc901abe (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < ad9a0374ee6d11048e1f74cd5180bad58b9848b4 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < b903e9b5629ec8dd6db92174070045bf81ad7060 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < e0665b2a8e90bb08bd205062c75662b502d31797 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 3dde4fb941fa5649ab809f6cd3e20e0c424a4e31 (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a (git) Affected: 8605330aac5a5785630aec8f64378a54891937cc , < 1ee90b77b727df903033db873c75caac5c27ec98 (git) Affected: cdaf15b43bd31003220cb080bcbbd57787a2fca9 (git) Affected: 4.10.14 , < 4.11 (semver) |
|
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:50:05.974Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24a0d548d3a765cd4558224e4f8e06e14cba26e3",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "71ff5cdd5da61d0438e902aa0fd68c28bc901abe",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "ad9a0374ee6d11048e1f74cd5180bad58b9848b4",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "b903e9b5629ec8dd6db92174070045bf81ad7060",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "e0665b2a8e90bb08bd205062c75662b502d31797",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "3dde4fb941fa5649ab809f6cd3e20e0c424a4e31",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "1ee90b77b727df903033db873c75caac5c27ec98",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"status": "affected",
"version": "cdaf15b43bd31003220cb080bcbbd57787a2fca9",
"versionType": "git"
},
{
"lessThan": "4.11",
"status": "affected",
"version": "4.10.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.10.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type == PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local socket syscalls on an AF_PACKET socket, including setsockopt(), sending traffic that is tapped as PACKET_OUTGOING, and recvmsg(). Remote packets alone do not reach the bug without a local attacker-controlled packet socket.\nAC:L - The attacker controls the socket options, packet-socket receive queue pressure/drop count, and outgoing traffic needed to make the timestamp cmsg path run. No uncontrollable race or rare environmental condition is required for the highest-impact disclosure/crash scenario.\nPR:L - Creating AF_PACKET sockets requires CAP_NET_RAW in the governing user namespace. Because this capability can be obtained by an unprivileged local user in user/network namespaces on common deployments, this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can configure the socket and trigger recvmsg() themselves. The bug is not dependent on opening a file, mounting media, or other user-assisted behavior.\nS:U - The impact remains within the kernel and the local host security authority. It does not cross a hypervisor, VM, IOMMU, or other separate security scope boundary.\nC:H - The bogus SCM_TIMESTAMPING_OPT_STATS cmsg can copy skb-\u003elen bytes from skb-\u003edata even when the skb is non-linear, reading past the linear head. That can disclose adjacent kernel heap contents to userspace, which is a high confidentiality impact.\nI:N - The investigated bug is an out-of-bounds read/copy-to-user and misclassification of skb metadata, not a kernel write primitive. I found no direct modification of kernel memory or protected data.\nA:H - The same invalid copy can trigger hardened usercopy failures or kernel oops/panic on hardened deployments. The local attacker can repeat the trigger, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:15.752Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3"
},
{
"url": "https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe"
},
{
"url": "https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4"
},
{
"url": "https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060"
},
{
"url": "https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797"
},
{
"url": "https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"
},
{
"url": "https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"
},
{
"url": "https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98"
}
],
"title": "net: guard timestamp cmsgs to real error queue skbs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53223",
"datePublished": "2026-06-25T08:39:24.588Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-09-08T08:50:05.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53228 (GCVE-0-2026-53228)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
EPSS
VEX
Title
ipv6: sit: reload inner IPv6 header after GSO offloads
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sit: reload inner IPv6 header after GSO offloads
ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function
entry and continues using it after iptunnel_handle_offloads().
For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().
When the skb header is cloned, skb_header_unclone() can call
pskb_expand_head(), which may move the skb head. The pskb_expand_head()
contract requires pointers into the skb header to be reloaded after the
call.
If the later skb_realloc_headroom() branch is not taken, SIT uses the
stale iph6 pointer to read the inner hop limit and DS field. That can
read from a freed skb head after the old head's remaining clone is
released.
Reload iph6 after the offload helper succeeds and before subsequent
reads from the inner IPv6 header. Keep the existing reload after
skb_realloc_headroom(), since that branch can also replace the skb.
Severity
9.8 (Critical)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/fddd41445a0537b09… | |
| https://git.kernel.org/stable/c/1132e5edc2866c353… | |
| https://git.kernel.org/stable/c/9c67b44edb3598d23… | |
| https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f… | |
| https://git.kernel.org/stable/c/59f80c919713250fe… | |
| https://git.kernel.org/stable/c/2fa49b2715e1bad12… | |
| https://git.kernel.org/stable/c/cb658c2f5f7977c2a… | |
| https://git.kernel.org/stable/c/f0e42f0c4337b1f22… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
14909664e4e192f4c6f6fcdccd9919af7cf783ab , < fddd41445a0537b093e6b3f6232c9933cad1e48b
(git)
Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < 1132e5edc2866c3530be17622153a597095f0e43 (git) Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < 9c67b44edb3598d234efae6e44649eb993c03da5 (git) Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < 0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0 (git) Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < 59f80c919713250fe5d25a4d9aea4e49580fa1d4 (git) Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < 2fa49b2715e1bad12ce3b0fa64e234d9582c8193 (git) Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c (git) Affected: 14909664e4e192f4c6f6fcdccd9919af7cf783ab , < f0e42f0c4337b1f220de1ddd63f47197c7dee4de (git) |
|
| Linux | Linux |
Affected:
3.18
Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/sit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fddd41445a0537b093e6b3f6232c9933cad1e48b",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "1132e5edc2866c3530be17622153a597095f0e43",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "9c67b44edb3598d234efae6e44649eb993c03da5",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "59f80c919713250fe5d25a4d9aea4e49580fa1d4",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "2fa49b2715e1bad12ce3b0fa64e234d9582c8193",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "f0e42f0c4337b1f220de1ddd63f47197c7dee4de",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/sit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel_handle_offloads().\n\nFor GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().\nWhen the skb header is cloned, skb_header_unclone() can call\npskb_expand_head(), which may move the skb head. The pskb_expand_head()\ncontract requires pointers into the skb header to be reloaded after the\ncall.\n\nIf the later skb_realloc_headroom() branch is not taken, SIT uses the\nstale iph6 pointer to read the inner hop limit and DS field. That can\nread from a freed skb head after the old head\u0027s remaining clone is\nreleased.\n\nReload iph6 after the offload helper succeeds and before subsequent\nreads from the inner IPv6 header. Keep the existing reload after\nskb_realloc_headroom(), since that branch can also replace the skb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SIT transmit path can be reached by network-triggered IPv6 traffic in a reasonable deployment where a public service or router sends large TCP/GSO packets through a configured SIT tunnel.\nAC:L - There is no race or fragile timing requirement; GSO and header-cloned TCP skbs are normal for large TCP transmissions, and the attacker can repeatedly trigger them with network traffic.\nPR:N - In the network-triggered scenario, the attacker does not need local privileges or authentication; the required SIT configuration is an environmental precondition on the victim.\nUI:N - No victim user action is required beyond the system processing network traffic through the configured SIT tunnel.\nS:U - The impact remains within the kernel and its networking security authority, with no VM, IOMMU, or separate security-scope boundary crossed.\nC:H - The stale inner IPv6 header pointer can read from freed skb head memory after `skb_header_unclone()`/`pskb_expand_head()`, making this a kernel use-after-free read. Per kernel CVSS guidance, use-after-free conditions are scored with high confidentiality impact.\nI:H - Although the immediate stale access feeds header fields, it is a kernel use-after-free in attacker-triggerable networking memory, and kernel UAFs are treated as potentially exploitable for heap manipulation and integrity compromise.\nA:H - Use-after-free in the kernel networking transmit path can lead to oops, panic, or repeated crash conditions, especially under memory debugging or unfavorable heap reuse."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:20.273Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b"
},
{
"url": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43"
},
{
"url": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5"
},
{
"url": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0"
},
{
"url": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4"
},
{
"url": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193"
},
{
"url": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c"
},
{
"url": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de"
}
],
"title": "ipv6: sit: reload inner IPv6 header after GSO offloads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53228",
"datePublished": "2026-06-25T08:39:27.893Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-08-05T12:34:20.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53239 (GCVE-0-2026-53239)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50
VLAI
EPSS
VEX
Title
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Fix the race by pruning the bin while still holding xfrm_policy_lock,
before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since
the lock is already held. The wrapper xfrm_policy_inexact_prune_bin()
becomes unused and is removed.
Race:
CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)
========================== ==========================
xfrm_policy_bysel_ctx():
spin_lock_bh(xfrm_policy_lock)
bin = xfrm_policy_inexact_lookup()
__xfrm_policy_unlink(pol)
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_kill(ret)
// wide window, lock not held
xfrm_hash_rebuild():
spin_lock_bh(xfrm_policy_lock)
__xfrm_policy_inexact_flush():
kfree_rcu(bin) // bin freed
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_inexact_prune_bin(bin)
// UAF: bin is freed
Severity
7.8 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/8fc536e9f6856230f… | |
| https://git.kernel.org/stable/c/c4c1ea36d83bf3c45… | |
| https://git.kernel.org/stable/c/25c8c7fb3b0b9668c… | |
| https://git.kernel.org/stable/c/42827d03f8009a6a2… | |
| https://git.kernel.org/stable/c/88697cf980222d590… | |
| https://git.kernel.org/stable/c/b5316e2b8614a87d8… | |
| https://git.kernel.org/stable/c/ec82ea4eb220164d8… | |
| https://git.kernel.org/stable/c/7f2d76c9c03257c07… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6be3b0db6db82cf056a72cc18042048edd27f8ee , < 8fc536e9f6856230f19c7d13e71af064b6a77b22
(git)
Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < c4c1ea36d83bf3c4569468ca5b8b614fda1bf821 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 25c8c7fb3b0b9668c7d05e209f58c158d2b020c7 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 42827d03f8009a6a218bacab153e21f39d6a121c (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 88697cf980222d5906a37bf47662dac0732e2a0f (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < b5316e2b8614a87d8736941972441cb47bfd4491 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < ec82ea4eb220164d854f8734ca5a35e23e577b94 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 7f2d76c9c03257c0782afef9d95321fa04096f60 (git) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:50:08.903Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8fc536e9f6856230f19c7d13e71af064b6a77b22",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "c4c1ea36d83bf3c4569468ca5b8b614fda1bf821",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "25c8c7fb3b0b9668c7d05e209f58c158d2b020c7",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "42827d03f8009a6a218bacab153e21f39d6a121c",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "88697cf980222d5906a37bf47662dac0732e2a0f",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "b5316e2b8614a87d8736941972441cb47bfd4491",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "ec82ea4eb220164d854f8734ca5a35e23e577b94",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "7f2d76c9c03257c0782afef9d95321fa04096f60",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)\n ========================== ==========================\n xfrm_policy_bysel_ctx():\n spin_lock_bh(xfrm_policy_lock)\n bin = xfrm_policy_inexact_lookup()\n __xfrm_policy_unlink(pol)\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_kill(ret)\n // wide window, lock not held\n xfrm_hash_rebuild():\n spin_lock_bh(xfrm_policy_lock)\n __xfrm_policy_inexact_flush():\n kfree_rcu(bin) // bin freed\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_inexact_prune_bin(bin)\n // UAF: bin is freed"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through NETLINK_XFRM messages such as XFRM_MSG_DELPOLICY and XFRM_MSG_NEWSPDINFO, which require local netlink access rather than remote packet delivery.\nAC:L - The attacker controls both sides of the race by creating/deleting an inexact XFRM policy while concurrently triggering SPD hash rebuilds, with no required external victim state.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN, but the check is namespace-scoped via netlink_net_capable() and is reachable with CAP_NET_ADMIN in a user-created network namespace on systems allowing user namespaces.\nUI:N - No victim action is required; the attacker can issue the needed netlink messages directly.\nS:U - The vulnerability corrupts kernel networking/XFRM state within the same kernel security authority and does not cross a hypervisor, IOMMU, or separate trust boundary.\nC:H - This is a use-after-free of an XFRM inexact policy bin, and the stale freed object can be dereferenced after attacker-controlled heap reuse, making high confidentiality impact defensible.\nI:H - The stale bin is not only read but also passed into pruning logic that writes list/rhashtable/seqcount state, so exploitation can plausibly yield memory corruption and control-flow or data integrity compromise.\nA:H - The UAF can trigger kernel memory corruption, KASAN splats, oopses, or panics, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:25.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22"
},
{
"url": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"
},
{
"url": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"
},
{
"url": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c"
},
{
"url": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f"
},
{
"url": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491"
},
{
"url": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94"
},
{
"url": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60"
}
],
"title": "xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53239",
"datePublished": "2026-06-25T08:39:35.149Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-09-08T08:50:08.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53268 (GCVE-0-2026-53268)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50
VLAI
EPSS
VEX
Title
netfilter: conntrack_irc: fix possible out-of-bounds read
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack_irc: fix possible out-of-bounds read
When parsing fails after we've matched the command string we
should bail out instead of trying to match a different command.
This helper should be deprecated, given prevalence of TLS I doubt it has
any relevance in 2026.
Severity
8.2 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/4cdda7f868f48e2f8… | |
| https://git.kernel.org/stable/c/8a1d6e40dedfe1068… | |
| https://git.kernel.org/stable/c/0afc802160af0df61… | |
| https://git.kernel.org/stable/c/7c34f913052920832… | |
| https://git.kernel.org/stable/c/ddddd8271359961e4… | |
| https://git.kernel.org/stable/c/9e5da2379f968a3ea… | |
| https://git.kernel.org/stable/c/573810f61bcd6b681… | |
| https://git.kernel.org/stable/c/66eba0ffce3b7e114… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
869f37d8e48f3911eb70f38a994feaa8f8380008 , < 4cdda7f868f48e2f81579371584fdbdce37df2c8
(git)
Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < 8a1d6e40dedfe1068aee094d851bd69e289c9fd6 (git) Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < 0afc802160af0df61ed374fdb97fb34cfe5cdf2f (git) Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < 7c34f91305292083253df6a9f6c8ede02d4ccaea (git) Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < ddddd8271359961e403d11c90c9ba9fc38914f7e (git) Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < 9e5da2379f968a3ea5a6e38921ab6201576466dc (git) Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < 573810f61bcd6b6815e2ff53bbdd2b9c9d747176 (git) Affected: 869f37d8e48f3911eb70f38a994feaa8f8380008 , < 66eba0ffce3b7e11449946b4cbbef8ea36112f56 (git) |
|
| Linux | Linux |
Affected:
2.6.20
Unaffected: 0 , < 2.6.20 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:50:11.810Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_irc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4cdda7f868f48e2f81579371584fdbdce37df2c8",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "8a1d6e40dedfe1068aee094d851bd69e289c9fd6",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "0afc802160af0df61ed374fdb97fb34cfe5cdf2f",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "7c34f91305292083253df6a9f6c8ede02d4ccaea",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "ddddd8271359961e403d11c90c9ba9fc38914f7e",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "9e5da2379f968a3ea5a6e38921ab6201576466dc",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "573810f61bcd6b6815e2ff53bbdd2b9c9d747176",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "66eba0ffce3b7e11449946b4cbbef8ea36112f56",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_irc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack_irc: fix possible out-of-bounds read\n\nWhen parsing fails after we\u0027ve matched the command string we\nshould bail out instead of trying to match a different command.\n\nThis helper should be deprecated, given prevalence of TLS I doubt it has\nany relevance in 2026."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable IRC conntrack helper parses attacker-controlled TCP payloads on network flows when the helper is attached, such as an IRC-exposed host or firewall/NAT deployment. A remote peer can establish the TCP flow and send the crafted IRC/CTCP DCC text that reaches `help()`.\nAC:L - Once the helper is enabled/assigned, triggering is deterministic packet parsing with attacker-controlled payload bytes and no race or hard-to-shape kernel state. The established-flow requirement is attacker-controlled by completing a normal TCP handshake.\nPR:N - The network attacker does not need local credentials or authenticated IRC privileges to send payload on a tracked TCP connection. Helper configuration requires administrative privileges, but that is deployment state, not attacker privilege.\nUI:N - No victim user action is needed after the vulnerable helper is active on the network path. The attacker only sends network traffic.\nS:U - The impact is within the kernel/netfilter security authority of the affected system. There is no VM, IOMMU, or separate security-scope boundary crossed.\nC:L - This is an out-of-bounds read from the IRC payload buffer/parser state, but the overread is constrained by short command comparisons and parser checks rather than an arbitrary kernel memory read primitive. Under the higher-severity tie-break rule, limited confidentiality impact is appropriate for the possible stale/adjacent-byte exposure.\nI:N - The bug is a read-side parser bounds error and does not write attacker-controlled data to kernel memory or provide a direct modification primitive. Any conntrack expectation changes require passing the helper\u0027s normal DCC validation path and are not arbitrary integrity compromise.\nA:H - The malformed payload can drive `memcmp()`/parser reads beyond the valid copied payload window, and with large/nonlinear packets this can go past the helper\u0027s guard byte and plausibly fault/oops in kernel context. The packet can be resent repeatedly for denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:45.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4cdda7f868f48e2f81579371584fdbdce37df2c8"
},
{
"url": "https://git.kernel.org/stable/c/8a1d6e40dedfe1068aee094d851bd69e289c9fd6"
},
{
"url": "https://git.kernel.org/stable/c/0afc802160af0df61ed374fdb97fb34cfe5cdf2f"
},
{
"url": "https://git.kernel.org/stable/c/7c34f91305292083253df6a9f6c8ede02d4ccaea"
},
{
"url": "https://git.kernel.org/stable/c/ddddd8271359961e403d11c90c9ba9fc38914f7e"
},
{
"url": "https://git.kernel.org/stable/c/9e5da2379f968a3ea5a6e38921ab6201576466dc"
},
{
"url": "https://git.kernel.org/stable/c/573810f61bcd6b6815e2ff53bbdd2b9c9d747176"
},
{
"url": "https://git.kernel.org/stable/c/66eba0ffce3b7e11449946b4cbbef8ea36112f56"
}
],
"title": "netfilter: conntrack_irc: fix possible out-of-bounds read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53268",
"datePublished": "2026-06-25T08:39:54.511Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-09-08T08:50:11.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53275 (GCVE-0-2026-53275)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50
VLAI
EPSS
VEX
Title
ipv6: mcast: Fix use-after-free when processing MLD queries
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: Fix use-after-free when processing MLD queries
When processing an MLD query, a pointer to the multicast group address
is retrieved when initially parsing the packet. This pointer is later
dereferenced without being reloaded despite the fact that the skb header
might have been reallocated following the pskb_may_pull() calls, leading
to a use-after-free [1].
Fix by copying the multicast group address when the packet is initially
parsed.
[1]
BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)
Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118
Workqueue: mld mld_query_work
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_address_description.constprop.0 (mm/kasan/report.c:378)
print_report (mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
__mld_query_work (net/ipv6/mcast.c:1512)
mld_query_work (net/ipv6/mcast.c:1563)
process_one_work (kernel/workqueue.c:3314)
worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
</TASK>
[...]
Freed by task 118:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
pskb_expand_head (net/core/skbuff.c:2335)
__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))
__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))
mld_query_work (net/ipv6/mcast.c:1563)
process_one_work (kernel/workqueue.c:3314)
worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Severity
8.8 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/dfaf1f5e7eb81be87… | |
| https://git.kernel.org/stable/c/1354271c89d0e5fbf… | |
| https://git.kernel.org/stable/c/53baa63a418329157… | |
| https://git.kernel.org/stable/c/2a613bf497029d555… | |
| https://git.kernel.org/stable/c/b2eb8886200b907fc… | |
| https://git.kernel.org/stable/c/4203806f700bb44ea… | |
| https://git.kernel.org/stable/c/087dbacf897c020f4… | |
| https://git.kernel.org/stable/c/791c91dc7a9dfb245… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
97300b5fdfe28c6edae926926f9467a27cf5889c , < dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea
(git)
Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 1354271c89d0e5fbf8b3d94097ff0216695209c7 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 53baa63a4183291574483f89583dbef13677a2c4 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 2a613bf497029d555a7428406aa8cdb84a503cea (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < b2eb8886200b907fc71806869620609f0f4cacb0 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 4203806f700bb44ea0b05d484d9d40044b47fb04 (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 087dbacf897c020f438f780f0a4a8aa73b6d7c5a (git) Affected: 97300b5fdfe28c6edae926926f9467a27cf5889c , < 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 (git) |
|
| Linux | Linux |
Affected:
2.6.15
Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.269 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:50:14.669Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "1354271c89d0e5fbf8b3d94097ff0216695209c7",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "53baa63a4183291574483f89583dbef13677a2c4",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "2a613bf497029d555a7428406aa8cdb84a503cea",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "b2eb8886200b907fc71806869620609f0f4cacb0",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "4203806f700bb44ea0b05d484d9d40044b47fb04",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "087dbacf897c020f438f780f0a4a8aa73b6d7c5a",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
},
{
"lessThan": "791c91dc7a9dfb2457d5e29b8216a6484b9c4b40",
"status": "affected",
"version": "97300b5fdfe28c6edae926926f9467a27cf5889c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Fix use-after-free when processing MLD queries\n\nWhen processing an MLD query, a pointer to the multicast group address\nis retrieved when initially parsing the packet. This pointer is later\ndereferenced without being reloaded despite the fact that the skb header\nmight have been reallocated following the pskb_may_pull() calls, leading\nto a use-after-free [1].\n\nFix by copying the multicast group address when the packet is initially\nparsed.\n\n[1]\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\n\nWorkqueue: mld mld_query_work\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\nprint_report (mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\n__mld_query_work (net/ipv6/mcast.c:1512)\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\u003c/TASK\u003e\n\n[...]\n\nFreed by task 118:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\npskb_expand_head (net/core/skbuff.c:2335)\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable MLD query handler is reached by received ICMPv6 MLD Query packets, but the code requires a link-local IPv6 source, Hop Limit 1, and the MLD Router Alert option, making the highest defensible reachability an adjacent same-link attacker.\nAC:L - The attacker controls the packet contents, MLDv2 source count, and packet layout needed to trigger the stale skb-header pointer after pskb_may_pull(); there is no victim-controlled race or authentication-dependent state.\nPR:N - No local privileges or authentication are required; any adjacent network peer able to send crafted IPv6 MLD queries to the host can reach igmp6_event_query() and the queued mld_query_work path.\nUI:N - Exploitation is triggered by packet reception and asynchronous kernel workqueue processing without any required victim user action.\nS:U - The bug is in the host kernel IPv6 multicast listener processing and impacts the same kernel security authority, with no VM, IOMMU, or separate-scope boundary crossed.\nC:H - This is a use-after-free in kernel networking code; under the required conservative kernel guidance, UAFs are treated as capable of enabling high-impact information disclosure.\nI:H - Although the immediate stale access is a freed-memory read used in address comparison, it is still a kernel UAF and must be scored conservatively as potentially exploitable for memory corruption/control-flow impact.\nA:H - The commit includes a KASAN-confirmed slab-use-after-free in __mld_query_work(), and kernel UAFs can cause oops/panic or repeated denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:49:38.838Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dfaf1f5e7eb81be87582bd6a57d34e61a57d5dea"
},
{
"url": "https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7"
},
{
"url": "https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4"
},
{
"url": "https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea"
},
{
"url": "https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0"
},
{
"url": "https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04"
},
{
"url": "https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a"
},
{
"url": "https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40"
}
],
"title": "ipv6: mcast: Fix use-after-free when processing MLD queries",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53275",
"datePublished": "2026-06-25T08:39:59.115Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-09-08T08:50:14.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63917 (GCVE-0-2026-63917)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_changelink().
ip netns add ns1
ip netns add ns2
ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7
ip -n ns1 link set vti6_test netns ns2
ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9
ip netns del ns2
ip netns del ns1
[ 132.495484] ------------[ cut here ]------------
[ 132.497609] kernel BUG at net/core/dev.c:12376!
Commit 61220ab34948 ("vti6: Enable namespace changing") dropped
NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then
move through IFLA_NET_NS_FD. After the move dev_net(dev) points
at the new netns while t->net stays at the creation netns.
vti6_changelink() and vti6_update() still use dev_net(dev) and
dev_net(t->dev). They unlink from one per netns hash and relink
into another. The creation netns is left with a stale entry.
cleanup_net() of that netns later walks freed memory.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/0cdce7618464f7fb0… | |
| https://git.kernel.org/stable/c/f5c68875e25f331e4… | |
| https://git.kernel.org/stable/c/d9c5eecdb3c740e65… | |
| https://git.kernel.org/stable/c/f1e89a943ee574d0f… | |
| https://git.kernel.org/stable/c/225b467e3b631f38b… | |
| https://git.kernel.org/stable/c/fc32be9ac2788524c… | |
| https://git.kernel.org/stable/c/ee1778ba0f5cb53be… | |
| https://git.kernel.org/stable/c/11b326fb0a374f465… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
61220ab349485d911083d0b7990ccd3db6c63297 , < 0cdce7618464f7fb06f461e8f4ad575cb1d570f4
(git)
Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < f5c68875e25f331e497ddfbe81e2d8163a87f136 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < d9c5eecdb3c740e65038651db7c686b10d76d1bc (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < f1e89a943ee574d0f2f16246eb3f2d7330fdeb03 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 225b467e3b631f38be22e4b38062a1fed02fdd21 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < fc32be9ac2788524c6b24efd681cce7a6e731a92 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < ee1778ba0f5cb53be771f97017d01eb356c797bf (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe (git) |
|
| Linux | Linux |
Affected:
3.15
Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cdce7618464f7fb06f461e8f4ad575cb1d570f4",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f5c68875e25f331e497ddfbe81e2d8163a87f136",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d9c5eecdb3c740e65038651db7c686b10d76d1bc",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f1e89a943ee574d0f2f16246eb3f2d7330fdeb03",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "225b467e3b631f38be22e4b38062a1fed02fdd21",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "fc32be9ac2788524c6b24efd681cce7a6e731a92",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "ee1778ba0f5cb53be771f97017d01eb356c797bf",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[ 132.495484] ------------[ cut here ]------------\n[ 132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t-\u003enet stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t-\u003edev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker\u0027s security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:11.588Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4"
},
{
"url": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136"
},
{
"url": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc"
},
{
"url": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03"
},
{
"url": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21"
},
{
"url": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92"
},
{
"url": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf"
},
{
"url": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe"
}
],
"title": "ip6: vti: Use ip6_tnl.net in vti6_changelink().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63917",
"datePublished": "2026-07-19T14:55:20.703Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:11.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63919 (GCVE-0-2026-63919)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
xfrm: input: hold netns during deferred transport reinjection
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: input: hold netns during deferred transport reinjection
Transport-mode reinjection stores a struct net pointer in skb->cb and
uses it later from xfrm_trans_reinject(). That pointer must stay valid
until the deferred callback runs.
Take a netns reference when queueing deferred reinjection work and drop
it after the callback completes. Use maybe_get_net() so the queueing
path does not revive a namespace that is already being torn down.
This keeps the existing workqueue design and fixes the netns lifetime
handling in one place for all users of xfrm_trans_queue_net().
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/7ee59eda8820b758e… | |
| https://git.kernel.org/stable/c/2df7059a18afb7d3a… | |
| https://git.kernel.org/stable/c/8dfabcba6a943a7a0… | |
| https://git.kernel.org/stable/c/48ce101cd630d6745… | |
| https://git.kernel.org/stable/c/55ddfc41451f01c58… | |
| https://git.kernel.org/stable/c/9f7ebb45a83afc321… | |
| https://git.kernel.org/stable/c/9f67a36e91bb50d35… | |
| https://git.kernel.org/stable/c/c16f74dc1d75d0e2e… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7b3801927e52f8621de311277f7fc727635019e7 , < 7ee59eda8820b758ed29e1cd3222359c7b97302c
(git)
Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 2df7059a18afb7d3aee6c36cad5d371c198111d4 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 8dfabcba6a943a7a02ebe1e1637c361ba96acbaa (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 48ce101cd630d6745b6923b5bad8358bc4c119da (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 55ddfc41451f01c588089cd74957a05311b6f202 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 9f7ebb45a83afc3216e855e57d51bb4bc9b5232e (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 9f67a36e91bb50d358760f381f233913fe5c09f8 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < c16f74dc1d75d0e2e7670076d5375deda110ebeb (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ee59eda8820b758ed29e1cd3222359c7b97302c",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "2df7059a18afb7d3aee6c36cad5d371c198111d4",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "8dfabcba6a943a7a02ebe1e1637c361ba96acbaa",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "48ce101cd630d6745b6923b5bad8358bc4c119da",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "55ddfc41451f01c588089cd74957a05311b6f202",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "9f7ebb45a83afc3216e855e57d51bb4bc9b5232e",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "9f67a36e91bb50d358760f381f233913fe5c09f8",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "c16f74dc1d75d0e2e7670076d5375deda110ebeb",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: input: hold netns during deferred transport reinjection\n\nTransport-mode reinjection stores a struct net pointer in skb-\u003ecb and\nuses it later from xfrm_trans_reinject(). That pointer must stay valid\nuntil the deferred callback runs.\n\nTake a netns reference when queueing deferred reinjection work and drop\nit after the callback completes. Use maybe_get_net() so the queueing\npath does not revive a namespace that is already being torn down.\n\nThis keeps the existing workqueue design and fixes the netns lifetime\nhandling in one place for all users of xfrm_trans_queue_net()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:13.727Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c"
},
{
"url": "https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4"
},
{
"url": "https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa"
},
{
"url": "https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da"
},
{
"url": "https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202"
},
{
"url": "https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e"
},
{
"url": "https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8"
},
{
"url": "https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb"
}
],
"title": "xfrm: input: hold netns during deferred transport reinjection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63919",
"datePublished": "2026-07-19T14:55:22.121Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:13.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63921 (GCVE-0-2026-63921)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
After patch 1/2 in this series, vti6_update() unlinks and relinks
the tunnel through t->net. vti6_siocdevprivate() still uses
dev_net(dev) for the collision lookup. For a tunnel moved through
IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.
SIOCCHGTUNNEL on a migrated tunnel then runs:
net = dev_net(dev) /* migrated netns */
t = vti6_locate(net, &p1, false) /* misses target in t->net */
...
t = netdev_priv(dev)
vti6_update(t, &p1, false) /* mutates t->net's hash */
A caller in the migrated netns picks params that match a tunnel
in the creation netns. The lookup in dev_net(dev) finds nothing.
vti6_update() prepends the migrated tunnel at the head of the
creation netns hash bucket for those params. Later lookups in
the creation netns resolve to the migrated device. xfrm receive
delivers the matched packets through a device the caller controls.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Switch the SIOCCHGTUNNEL path on a non fallback device to use
t->net for the lookup. The lookup now matches the netns
vti6_update() operates on.
Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before
the lookup. The check at the top of the case is against
dev_net(dev)->user_ns, which after migration is the attacker's
netns. A caller there can pick params absent from self->net,
the lookup returns NULL, t becomes self, and vti6_update()
inserts the device into the creation netns hash. The new check
requires CAP_NET_ADMIN in the creation netns user_ns too.
SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep
dev_net(dev), which equals init_net there.
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/94ff740a7f9ef5c01… | |
| https://git.kernel.org/stable/c/df42ac708acc3399b… | |
| https://git.kernel.org/stable/c/44d2ff7d2178503b9… | |
| https://git.kernel.org/stable/c/1acfb7d9c6fc7e209… | |
| https://git.kernel.org/stable/c/d2236348414bdd655… | |
| https://git.kernel.org/stable/c/853f6ea482dfcd340… | |
| https://git.kernel.org/stable/c/596f6354c96a891e5… | |
| https://git.kernel.org/stable/c/8b484efd5cb4eeef9… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
61220ab349485d911083d0b7990ccd3db6c63297 , < 94ff740a7f9ef5c010784a325dca00cbf228f941
(git)
Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < df42ac708acc3399bbb6dc5ca16e0540adda7bbf (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 44d2ff7d2178503b93151140a45dfa2ad49c9906 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 1acfb7d9c6fc7e209ed7789392697e97e03edd33 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < d2236348414bdd6558385f35aa7fdc9bf5634011 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 853f6ea482dfcd3404bbef458ab4d68364eed838 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 596f6354c96a891e58c04a09cbfb7b0d1ec00dab (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 8b484efd5cb4eeef9021a661e198edc5349dacf6 (git) |
|
| Linux | Linux |
Affected:
3.15
Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94ff740a7f9ef5c010784a325dca00cbf228f941",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "df42ac708acc3399bbb6dc5ca16e0540adda7bbf",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "44d2ff7d2178503b93151140a45dfa2ad49c9906",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "1acfb7d9c6fc7e209ed7789392697e97e03edd33",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d2236348414bdd6558385f35aa7fdc9bf5634011",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "853f6ea482dfcd3404bbef458ab4d68364eed838",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "596f6354c96a891e58c04a09cbfb7b0d1ec00dab",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "8b484efd5cb4eeef9021a661e198edc5349dacf6",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t-\u003enet. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t-\u003enet.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n net = dev_net(dev) /* migrated netns */\n t = vti6_locate(net, \u0026p1, false) /* misses target in t-\u003enet */\n ...\n t = netdev_priv(dev)\n vti6_update(t, \u0026p1, false) /* mutates t-\u003enet\u0027s hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt-\u003enet for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self-\u003enet-\u003euser_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)-\u003euser_ns, which after migration is the attacker\u0027s\nnetns. A caller there can pick params absent from self-\u003enet,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace\u0027s user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant\u0027s network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker\u0027s own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant\u0027s network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim\u0027s IPsec connectivity."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:15.900Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941"
},
{
"url": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf"
},
{
"url": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906"
},
{
"url": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33"
},
{
"url": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011"
},
{
"url": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838"
},
{
"url": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab"
},
{
"url": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6"
}
],
"title": "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63921",
"datePublished": "2026-07-19T14:55:23.539Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:15.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64002 (GCVE-0-2026-64002)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:38
VLAI
EPSS
VEX
Title
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports
too soon.
Only after unregister_net_sysctl_table() we can be sure no threads can possibly
use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.
Severity
7.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/ecf45080a4d3f4526… | |
| https://git.kernel.org/stable/c/a0ffc6081a8b27082… | |
| https://git.kernel.org/stable/c/5b23a2ff379e70b6b… | |
| https://git.kernel.org/stable/c/8e59d4d0dcde2dfb0… | |
| https://git.kernel.org/stable/c/6512c57c4638ddec1… | |
| https://git.kernel.org/stable/c/a7f4eefb6e1458431… | |
| https://git.kernel.org/stable/c/155f90be5ee8be5b1… | |
| https://git.kernel.org/stable/c/87a1e0fe7776da7ab… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
122ff243f5f104194750ecbc76d5946dd1eec934 , < ecf45080a4d3f4526cacb8b14060fe3b49a6913b
(git)
Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c (git) Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < 5b23a2ff379e70b6b9ff744a972b63e1f8f4d996 (git) Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < 8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57 (git) Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < 6512c57c4638ddec113bf42439361ba85a12048d (git) Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < a7f4eefb6e1458431eef9fa20fb363320d185f76 (git) Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < 155f90be5ee8be5b110ebc0b7da33c54c83b0208 (git) Affected: 122ff243f5f104194750ecbc76d5946dd1eec934 , < 87a1e0fe7776da7ab411be332b4be58ac8840d10 (git) |
|
| Linux | Linux |
Affected:
3.16
Unaffected: 0 , < 3.16 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecf45080a4d3f4526cacb8b14060fe3b49a6913b",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "5b23a2ff379e70b6b9ff744a972b63e1f8f4d996",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "6512c57c4638ddec113bf42439361ba85a12048d",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "a7f4eefb6e1458431eef9fa20fb363320d185f76",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "155f90be5ee8be5b110ebc0b7da33c54c83b0208",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "87a1e0fe7776da7ab411be332b4be58ac8840d10",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net-\u003eipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls\u2014network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect\u2014not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker\u0027s own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:02.672Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b"
},
{
"url": "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c"
},
{
"url": "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996"
},
{
"url": "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57"
},
{
"url": "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d"
},
{
"url": "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76"
},
{
"url": "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208"
},
{
"url": "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10"
}
],
"title": "ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64002",
"datePublished": "2026-07-19T14:56:19.495Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-08-05T12:38:02.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…