{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e4f5c3f01fb0e51ca438e43262d858daf9a0a76",
              "status": "affected",
              "version": "4fcd1813e6404dd4420c7d12fb483f9320f0bf93",
              "versionType": "git"
            },
            {
              "lessThan": "759ffc164d95a32c09528766d74d9b4fb054e8f4",
              "status": "affected",
              "version": "4fcd1813e6404dd4420c7d12fb483f9320f0bf93",
              "versionType": "git"
            },
            {
              "lessThan": "99f280700b4cc02d5f141b8d15f8e9fad0418f65",
              "status": "affected",
              "version": "4fcd1813e6404dd4420c7d12fb483f9320f0bf93",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "655e0c067f0e02ece03fd0591dabe3db2ae27552",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "875cc09c0767a4ac06b57af383709657f98b3ea1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "599fe1409085059ba12a2c3897c853be9fa9e7cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2e4378ee60049b752c9dce16f62ce6fbd11b379a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "59b520454b323ec43b2ae757217332cea33091e0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e20c888e2b3576e5f498c167729d274ef60b86f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4ce7aa4e44d88ce64ea8ae2337b8910f3670b0ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "419fad68e4c4135ff9859e9214dd6cf954413ca1",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.103",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.63",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.74",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.37",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.37",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.28",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.16",
              "versionType": "semver"
            },
            {
              "lessThan": "4.7",
              "status": "affected",
              "version": "4.6.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.47",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.12",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.74",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix session state check in reconnect to avoid use-after-free issue\n\nDon\u0027t collect exiting session in smb2_reconnect_server(), because it\nwill be released soon.\n\nNote that the exiting session will stay in server-\u003esmb_ses_list until\nit complete the cifs_free_ipc() and logoff() and then delete itself\nfrom the list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the SMB/CIFS client\u0027s reconnect worker, whose execution and timing are dictated entirely by a remote SMB peer (TCP resets, malformed PDUs, STATUS_NETWORK_SESSION_EXPIRED, stalled SMB2_LOGOFF replies, DFS referrals). A malicious/compromised file server or an on-path attacker triggers it purely over TCP/445 with no local access.\nAC:L - The attacker controls both sides of the race: it stalls the SMB2_LOGOFF response to hold the session in SES_EXITING on smb_ses_list for the full response timeout, while forcing smb2_reconnect_server() to run on demand and repeatedly (it also self-requeues every 2 seconds), making the window trivially wide and the hit near-certain.\nPR:N - No credentials or privileges on the victim system are required \u2014 the attacker is the remote server (or an on-path attacker) acting against an existing mount, and the triggering conditions are protocol-level responses that require no authenticated privilege on the client.\nUI:N - Against an already-established mount (fstab, autofs, systemd automount, container share) the attack proceeds with no victim action; the session teardown side is generated by normal client activity such as DFS referral handling and session churn that the attacker itself induces.\nS:U - The freed and reused objects (struct cifs_ses, struct cifs_tcon) and the resulting corruption all live within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other security scope.\nC:H - A use-after-free on a heap-allocated cifs_ses/cifs_tcon lets the attacker groom the freed slab and have the reconnect path read session fields (Suid, auth_key.response, chans[], dfs_root_ses) out of attacker-influenced memory, yielding a kernel information-disclosure primitive.\nI:H - The worker writes into the freed objects \u2014 list_add_tail() stores two pointers into ses-\u003erlist and the freed tcon_ipc-\u003erlist, ses_count is incremented through a dangling dfs_root_ses pointer, and cifs_setup_session() writes ses_status/Suid and frees ses-\u003eauth_key.response \u2014 giving write and controlled-free primitives usable for control-flow hijack.\nA:H - The use-after-free reliably corrupts kernel memory, taking spinlocks and mutexes inside a freed allocation and corrupting list heads, which oopses or panics the machine and can hang the cifs workqueue."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:01.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e4f5c3f01fb0e51ca438e43262d858daf9a0a76"
        },
        {
          "url": "https://git.kernel.org/stable/c/759ffc164d95a32c09528766d74d9b4fb054e8f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/99f280700b4cc02d5f141b8d15f8e9fad0418f65"
        }
      ],
      "title": "cifs: fix session state check in reconnect to avoid use-after-free issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53794",
    "datePublished": "2025-12-09T00:00:51.061Z",
    "dateReserved": "2025-12-08T23:58:35.274Z",
    "dateUpdated": "2026-08-05T09:16:01.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/crypto/mpi/mpi-cmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fde791e8a96a64ea7b0ad2440e43586447a209c6",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "ae63e84ffda74267bf7277c38415ba38389229a0",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "61f5453e9706e99713825594e0c8f9031485fb5f",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "0fc7147c694394f8a8cbc19570c6bc918cac0906",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "67589d247909043e94d2dd5fb590958e0f99d58d",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "d3ad023a39f1127dcfd331c562673355dc078650",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "12ac013ad7ff0df066451e825801d805095b3776",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            },
            {
              "lessThan": "9e47a758b70167c9301d2b44d2569f86c7796f2d",
              "status": "affected",
              "version": "12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/crypto/mpi/mpi-cmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.326",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.257",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.326",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.295",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.257",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.197",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.133",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.55",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.5",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()\n\nDuring NVMeTCP Authentication a controller can trigger a kernel\noops by specifying the 8192 bit Diffie Hellman group and passing\na correctly sized, but zeroed Diffie Hellamn value.\nmpi_cmp_ui() was detecting this if the second parameter was 0,\nbut 1 is passed from dh_is_pubkey_valid(). This causes the null\npointer u-\u003ed to be dereferenced towards the end of mpi_cmp_ui()"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached from NVMe-over-Fabrics (NVMe/TCP) DH-HMAC-CHAP authentication data received from a remote peer \u2014 either a malicious/MITM controller sending a Challenge to a host, or a remote initiator sending a Reply to an nvmet-tcp target on TCP/4420. The attacker-controlled bytes travel over the network with no locality requirement.\nAC:L - Triggering is fully deterministic: the attacker simply advertises a non-NULL DH group (e.g. ffdhe8192) and supplies a correctly sized but all-zero DH value, which makes mpi_read_raw_from_sgl() produce an MPI with nlimbs==0 and d==NULL. No race, no memory-layout dependency, and NVMe/TCP in-band authentication is a normal shipped configuration.\nPR:N - On the target side nvmet_auth_reply() computes the DH shared secret from the peer\u0027s DH value before the DH-HMAC-CHAP response HMAC is verified, so this is a pre-authentication code path; on the host side an impersonating/MITM controller needs no credentials to send the Challenge.\nUI:N - An nvmet-tcp target listens passively and the attacker drives the whole DH-HMAC-CHAP exchange; no local user action is required to trigger the oops.\nS:U - The NULL dereference crashes the kernel that is processing the authentication message; the impact stays within that kernel\u0027s own security authority with no boundary crossing.\nC:N - The fault is a read of address 0 (u-\u003ed[0]) that immediately oopses; no attacker-influenced memory is read back or returned to the peer, so no information is disclosed.\nI:N - The bug is a NULL pointer read, not a write or type confusion; nothing is corrupted and there is no primitive for modifying kernel memory or hijacking control flow.\nA:H - Dereferencing the NULL u-\u003ed produces a kernel oops in the NVMe auth work handler, killing the connection/worker and panicking the box under panic_on_oops, and it can be re-triggered on every new authentication attempt."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:11.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fde791e8a96a64ea7b0ad2440e43586447a209c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae63e84ffda74267bf7277c38415ba38389229a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/61f5453e9706e99713825594e0c8f9031485fb5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fc7147c694394f8a8cbc19570c6bc918cac0906"
        },
        {
          "url": "https://git.kernel.org/stable/c/67589d247909043e94d2dd5fb590958e0f99d58d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ad023a39f1127dcfd331c562673355dc078650"
        },
        {
          "url": "https://git.kernel.org/stable/c/12ac013ad7ff0df066451e825801d805095b3776"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e47a758b70167c9301d2b44d2569f86c7796f2d"
        }
      ],
      "title": "crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53817",
    "datePublished": "2025-12-09T00:01:15.411Z",
    "dateReserved": "2025-12-08T23:58:35.277Z",
    "dateUpdated": "2026-08-05T09:16:11.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f2d38e77aa5f3effc143e7dd24da8acf02925958",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "1351551aa9058e07a20a27a158270cf84fcde621",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "c02421992505c95c7f3c9ad59ee35e22eac60988",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "d9ba36c22a7bb09d6bac4cc2f243eff05da53f43",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "ac6725a634f7e8c0330610a8527f20c730b61115",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "348d446762e7c70778df8bafbdf3fa0df2123f58",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            },
            {
              "lessThan": "a2a9339e1c9deb7e1e079e12e27a0265aea8421a",
              "status": "affected",
              "version": "61d6ef3e3408cdf7e622646fb90a9f7f9560b943",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.313",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.281",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.313",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.281",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.241",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.178",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.108",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.25",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.12",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}\n\nSimilar to commit d0be8347c623 (\"Bluetooth: L2CAP: Fix use-after-free\ncaused by l2cap_chan_put\"), just use l2cap_chan_hold_unless_zero to\nprevent referencing a channel that is about to be destroyed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is reached only by processing an L2CAP Disconnect Request/Response signalling PDU received from a Bluetooth peer over a BR/EDR ACL or LE link, which requires the attacker to be within Bluetooth radio range. Per kernel scoring guidance, Bluetooth-reachable code is Adjacent.\nAC:L - The attacker drives both sides: it creates and tears down L2CAP channels at will (CONN_REQ/DISCONN_REQ, ECRED reconfigure responses that call l2cap_chan_del with no lock) while flooding disconnect signalling to hit the window where the kref has reached zero but the channel is still on conn-\u003echan_l, and can retry the connect/disconnect cycle indefinitely at no cost. syzbot reproduced the identical pattern in the sibling handler.\nPR:N - l2cap_recv_frame dispatches CID 0x0001/0x0005 straight to the signalling handlers with no security-level, pairing, or encryption check, so an entirely unauthenticated, unpaired in-range device can send the triggering PDU. Fixed channels present on conn-\u003echan_l give a valid target CID without any local socket.\nUI:N - No victim action is needed \u2014 the packet is processed by hci_rx_work as soon as it arrives on a connectable/advertising host with Bluetooth enabled, which is the default on phones, cars, headsets and laptops.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The handler reads chan-\u003escid and chan-\u003edcid out of the freed kmalloc-1k object and echoes them to the attacker in the Disconnect Response, giving a repeatable remote leak of reclaimed kernel heap contents, and the broader use-after-free permits arbitrary read via heap grooming.\nI:H - After the increment-on-zero the code performs three indirect calls (chan-\u003eops-\u003eset_shutdown, -\u003eteardown, -\u003eclose) through function pointers read from the freed object plus a list_del on freed list heads, so an attacker who sprays the reclaimed kmalloc-1024 slot obtains control-flow hijack and arbitrary-write primitives.\nA:H - The bug is a KASAN-confirmed use-after-free that mutex_locks freed memory and triggers a refcount_t \"increment on 0\" splat, reliably producing a kernel oops/panic, and it can be re-triggered remotely at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:16.899Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f2d38e77aa5f3effc143e7dd24da8acf02925958"
        },
        {
          "url": "https://git.kernel.org/stable/c/1351551aa9058e07a20a27a158270cf84fcde621"
        },
        {
          "url": "https://git.kernel.org/stable/c/c02421992505c95c7f3c9ad59ee35e22eac60988"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9ba36c22a7bb09d6bac4cc2f243eff05da53f43"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac6725a634f7e8c0330610a8527f20c730b61115"
        },
        {
          "url": "https://git.kernel.org/stable/c/348d446762e7c70778df8bafbdf3fa0df2123f58"
        },
        {
          "url": "https://git.kernel.org/stable/c/d82a439c3cfdb28aa7e82e2e849c5c4dd9fca284"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2a9339e1c9deb7e1e079e12e27a0265aea8421a"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53827",
    "datePublished": "2025-12-09T01:29:40.794Z",
    "dateReserved": "2025-12-09T01:27:17.825Z",
    "dateUpdated": "2026-08-05T09:16:16.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:44.548Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/libata-sff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "d5e6e3000309359eae2a17117aa6e3c44897bf6c",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "0dd5aade301a10f4b329fa7454fdcc2518741902",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "0a17a9944b8d89ef03946121241870ac53ddaf45",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "6e74e53b34b6dec5a50e1404e2680852ec6768d2",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/libata-sff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\nwrite outside the allocated buffer, overwriting random memory.\n\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\nto be a bug either in libata-sff or QEMU, where either this status is not\nset, or the status is cleared before read by ata_sff_hsm_move().\nAnyway, that is most likely a separate bug.\n\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\n\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\ncannot write outside the allocated buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered through the SCSI_IOCTL_SEND_COMMAND (or SG_IO) ioctl issued on a local ATA block device node, requiring local system access. There is no network-facing path into libata\u0027s PIO transfer code.\nAC:L - The attacker deterministically controls both required conditions \u2014 the buffer length (any out_len/in_len that is not a multiple of the 512-byte sector size) and the ATA sector count in the pass-through CDB \u2014 with no race, no memory-layout dependency, and no reliance on the device\u0027s error behaviour when a normal PIO read/write command is used.\nPR:L - The ATA_12 pass-through opcode 0xA1 aliases GPCMD_BLANK in scsi_cmd_allowed(), so it is permitted for any unprivileged user holding a write-opened fd on the block device \u2014 no CAP_SYS_RAWIO is needed \u2014 which is routinely the case for disk-group members, containers with device passthrough, and embedded/appliance images with permissive device nodes.\nUI:N - The attacker triggers the entire sequence from its own process via a single ioctl; no action by any other user or administrator is required.\nS:U - The out-of-bounds write corrupts kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - In the data-out direction (ATA_CMD_PIO_WRITE with an unaligned in_len) the kernel reads far past the end of the kmalloc\u0027d buffer and streams that kernel memory to attacker-chosen disk sectors, which can then simply be read back \u2014 an unbounded kernel-memory disclosure primitive.\nI:H - In the data-in direction the kernel writes up to ~128 KB of device-supplied data (contents of disk sectors the attacker previously wrote, hence fully controlled) past the end of a small slab allocation into adjacent pages, giving a controlled-content heap overflow suitable for control-flow hijacking and privilege escalation.\nA:H - Overwriting arbitrary adjacent kernel pages and slab metadata with attacker data reliably corrupts unrelated kernel structures, producing oopses, slab corruption BUGs, and full system panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:05.569Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5e6e3000309359eae2a17117aa6e3c44897bf6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dd5aade301a10f4b329fa7454fdcc2518741902"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a17a9944b8d89ef03946121241870ac53ddaf45"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e74e53b34b6dec5a50e1404e2680852ec6768d2"
        }
      ],
      "title": "ata: libata-sff: Ensure that we cannot write outside the allocated buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21738",
    "datePublished": "2025-02-27T02:12:13.942Z",
    "dateReserved": "2024-12-29T08:45:45.757Z",
    "dateUpdated": "2026-08-05T11:54:05.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr.h",
            "drivers/scsi/mpi3mr/mpi3mr_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "65ba18c84dbd03afe9b38c06c151239d97a09834",
              "status": "affected",
              "version": "c4f7ac64616ee513f9ac4ae6c4d8c3cccb6974df",
              "versionType": "git"
            },
            {
              "lessThan": "8d310d66e2b0f5f9f709764641647e8a3a4924fa",
              "status": "affected",
              "version": "c4f7ac64616ee513f9ac4ae6c4d8c3cccb6974df",
              "versionType": "git"
            },
            {
              "lessThan": "75b67dca4195e11ccf966a704787b2aa2754a457",
              "status": "affected",
              "version": "c4f7ac64616ee513f9ac4ae6c4d8c3cccb6974df",
              "versionType": "git"
            },
            {
              "lessThan": "f195fc060c738d303a21fae146dbf85e1595fb4c",
              "status": "affected",
              "version": "c4f7ac64616ee513f9ac4ae6c4d8c3cccb6974df",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr.h",
            "drivers/scsi/mpi3mr/mpi3mr_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue\n\nWhen the task management thread processes reply queues while the reset\nthread resets them, the task management thread accesses an invalid queue ID\n(0xFFFF), set by the reset thread, which points to unallocated memory,\ncausing a crash.\n\nAdd flag \u0027io_admin_reset_sync\u0027 to synchronize access between the reset,\nI/O, and admin threads. Before a reset, the reset handler sets this flag to\nblock I/O and admin processing threads. If any thread bypasses the initial\ncheck, the reset thread waits up to 10 seconds for processing to finish. If\nthe wait exceeds 10 seconds, the controller is marked as unrecoverable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a Broadcom MPI3 SAS/NVMe HBA driver path reached only through local I/O submission, SCSI error handling, or the /dev/bsg management node; there is no remote or adjacent-network reachability.\nAC:L - The attacker controls both sides of the race \u2014 sustained I/O to a device on the controller keeps threads inside mpi3mr_process_op_reply_q() (threaded IRQ poll, blk-mq poll, or SCSI-EH task-management polling), while the same load storm drives the timeout/EH escalation and reset paths that call mpi3mr_memset_buffers(); the window can be retried indefinitely with no attacker-uncontrollable precondition.\nPR:L - An unprivileged local user with access to any block device backed by the mpi3mr HBA can drive the polling side and induce the timeout-driven error-recovery side; the higher-privileged BSG reset path (CAP_SYS_RAWIO) only makes triggering more deterministic and is not required.\nUI:N - The race is triggered entirely by the attacker\u0027s own I/O and error-recovery activity; no action by another user or administrator is needed.\nS:U - The corruption is confined to the kernel\u0027s own memory and MMIO mappings within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The zeroed num_replies makes reply_ci grow without wrapping, so mpi3mr_get_reply_desc() reads segment pointers past the q_segments array and dereferences them, giving unbounded out-of-bounds kernel reads whose contents flow into reply/sense processing and can reach userspace.\nI:H - With qid/request_queue_id zeroed, WRITE_ONCE(mrioc-\u003ereq_qinfo[0xFFFF].ci, ...) performs an out-of-bounds write roughly 4.5 MB beyond the allocation into unrelated kernel heap, and writel() targets addresses ~512 KB outside the ioremap()ed BAR \u2014 memory corruption usable to build a write primitive.\nA:H - The commit explicitly states the invalid 0xFFFF queue ID points to unallocated memory and causes a crash; the writel() to oper_queue_indexes[0xFFFF] hits an unmapped kernel virtual address, producing a kernel oops and loss of the storage controller."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:53.888Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/65ba18c84dbd03afe9b38c06c151239d97a09834"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d310d66e2b0f5f9f709764641647e8a3a4924fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/75b67dca4195e11ccf966a704787b2aa2754a457"
        },
        {
          "url": "https://git.kernel.org/stable/c/f195fc060c738d303a21fae146dbf85e1595fb4c"
        }
      ],
      "title": "scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37861",
    "datePublished": "2025-05-09T06:42:07.245Z",
    "dateReserved": "2025-04-16T04:51:23.957Z",
    "dateUpdated": "2026-08-05T11:57:53.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38129",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:54.789942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:17.490Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/page_pool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c2c906142293931e33ef4be79ebc36c25c4e21dd",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            },
            {
              "lessThan": "d69f28ef7cdafdcf37ee310f38b1399e7d05f9a8",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            },
            {
              "lessThan": "1a8c0b61d4cb55c5440583ec9e7f86a730369e32",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            },
            {
              "lessThan": "4914c0a166540e534a0c1d43affd329d95fb56fd",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            },
            {
              "lessThan": "e869a85acc2e60dc554579b910826a4919d8cd98",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            },
            {
              "lessThan": "4ab8c0f8905c9c4d05e7f437e65a9a365573ff02",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            },
            {
              "lessThan": "271683bb2cf32e5126c592b5d5e6a756fa374fd9",
              "status": "affected",
              "version": "ff7d6b27f894f1469dc51ccb828b7363ccd9799f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/page_pool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: Fix use-after-free in page_pool_recycle_in_ring\n\nsyzbot reported a uaf in page_pool_recycle_in_ring:\n\nBUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862\nRead of size 8 at addr ffff8880286045a0 by task syz.0.284/6943\n\nCPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862\n __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline]\n _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210\n spin_unlock_bh include/linux/spinlock.h:396 [inline]\n ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline]\n page_pool_recycle_in_ring net/core/page_pool.c:707 [inline]\n page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826\n page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline]\n page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline]\n napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036\n skb_pp_recycle net/core/skbuff.c:1047 [inline]\n skb_free_head net/core/skbuff.c:1094 [inline]\n skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125\n skb_release_all net/core/skbuff.c:1190 [inline]\n __kfree_skb net/core/skbuff.c:1204 [inline]\n sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242\n kfree_skb_reason include/linux/skbuff.h:1263 [inline]\n __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline]\n\nroot cause is:\n\npage_pool_recycle_in_ring\n  ptr_ring_produce\n    spin_lock(\u0026r-\u003eproducer_lock);\n    WRITE_ONCE(r-\u003equeue[r-\u003eproducer++], ptr)\n      //recycle last page to pool\n\t\t\t\tpage_pool_release\n\t\t\t\t  page_pool_scrub\n\t\t\t\t    page_pool_empty_ring\n\t\t\t\t      ptr_ring_consume\n\t\t\t\t      page_pool_return_page  //release all page\n\t\t\t\t  __page_pool_destroy\n\t\t\t\t     free_percpu(pool-\u003erecycle_stats);\n\t\t\t\t     free(pool) //free\n\n     spin_unlock(\u0026r-\u003eproducer_lock); //pool-\u003ering uaf read\n  recycle_stat_inc(pool, ring);\n\npage_pool can be free while page pool recycle the last page in ring.\nAdd producer-lock barrier to page_pool_release to prevent the page\npool from being free before all pages have been recycled.\n\nrecycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not\nenabled, which will trigger Wempty-body build warning. Add definition\nfor pool stat macro to fix warning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires local operations \u2014 creating/tearing down a page_pool-backed netdev (veth NAPI/GRO toggle, XDP detach, `ip link set down`, channel/ring reconfiguration) while freeing socket-queued skbs via close/purge syscalls. A remote peer can supply the packets that populate the pool but cannot initiate `page_pool_destroy()`, so the attack vector is local.\nAC:L - The attacker controls both sides of the race: they create the page pool, park page_pool-backed skbs on their own socket receive queue, then concurrently destroy the pool and purge the queue from another thread. Per-attempt the window is short, but it is entirely attacker-created and repeatable indefinitely (the `page_pool_release_retry` worker re-opens it every DEFER_TIME), with no condition outside the attacker\u0027s influence.\nPR:L - The producer side (`skb_release_data` \u2192 `napi_pp_put_page` \u2192 `page_pool_recycle_in_ring`) needs no privileges at all \u2014 just an ordinary socket. The destroy side needs only CAP_NET_ADMIN inside a network namespace, which any unprivileged user obtains with `unshare -Urn` to create a veth pair and toggle its NAPI/XDP state; no real root in the init namespace is required.\nUI:N - The attacking process performs the pool teardown and the skb free itself from its own threads. No victim action or cooperating process is needed.\nS:U - The freed object and the corruption both live in the host kernel\u0027s own memory; no VM, hypervisor, or IOMMU boundary is crossed.\nC:H - This is a use-after-free on a `kzalloc_node()`-allocated `struct page_pool`, which an attacker can groom and replace with a controlled slab object; the stale `pool-\u003erecycle_stats` dereference then reads attacker-influenced kernel memory, and the lockdep `lock_release` path reads the freed `dep_map`, yielding a kernel-memory disclosure primitive.\nI:H - The racing producer writes into freed memory unconditionally \u2014 `r-\u003equeue[r-\u003eproducer++]` stores a netmem pointer, `r-\u003eproducer` is incremented, and `spin_unlock_bh()` performs a store-release to the freed lock word at a fixed offset in a reallocated object. With `CONFIG_PAGE_POOL_STATS`, `recycle_stat_inc(pool, ring)` additionally increments through a pointer read out of the reallocated object, giving a near-arbitrary write usable for control-flow hijack.\nA:H - The confirmed syzbot outcome is a KASAN slab-use-after-free splat (an oops, and a panic under `panic_on_warn`/`panic_on_oops`); unpoisoned, the stray writes corrupt the slab and the recycled page ends up double-owned, readily producing kernel panics and network-stack breakage."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:48.021Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c2c906142293931e33ef4be79ebc36c25c4e21dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d69f28ef7cdafdcf37ee310f38b1399e7d05f9a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a8c0b61d4cb55c5440583ec9e7f86a730369e32"
        },
        {
          "url": "https://git.kernel.org/stable/c/4914c0a166540e534a0c1d43affd329d95fb56fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e869a85acc2e60dc554579b910826a4919d8cd98"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ab8c0f8905c9c4d05e7f437e65a9a365573ff02"
        },
        {
          "url": "https://git.kernel.org/stable/c/271683bb2cf32e5126c592b5d5e6a756fa374fd9"
        }
      ],
      "title": "page_pool: Fix use-after-free in page_pool_recycle_in_ring",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38129",
    "datePublished": "2025-07-03T08:35:33.728Z",
    "dateReserved": "2025-04-16T04:51:23.987Z",
    "dateUpdated": "2026-08-05T11:59:48.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/kvaser_pciefd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d8a054b6e6824a8b52c3977ebd38c9583a63efac",
              "status": "affected",
              "version": "352fbde14177d608a54120b6ff559ce5b3cf6238",
              "versionType": "git"
            },
            {
              "lessThan": "a6550c9aa11e2f57f9cdaa6249cdd44d446be874",
              "status": "affected",
              "version": "8256e0ca601051933e9395746817f3801fa9a6bf",
              "versionType": "git"
            },
            {
              "lessThan": "54ec8b08216f3be2cc98b33633d3c8ea79749895",
              "status": "affected",
              "version": "8256e0ca601051933e9395746817f3801fa9a6bf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f14512f3ee09cda986191c8dd7f54972afa2c763",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.35",
              "status": "affected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/kvaser_pciefd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.12.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: kvaser_pciefd: refine error prone echo_skb_max handling logic\n\necho_skb_max should define the supported upper limit of echo_skb[]\nallocated inside the netdevice\u0027s priv. The corresponding size value\nprovided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT\nwhich is 17.\n\nBut later echo_skb_max is rounded up to the nearest power of two (for the\nmax case, that would be 32) and the tx/ack indices calculated further\nduring tx/rx may exceed the upper array boundary. Kasan reported this for\nthe ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit\nfunction has actually caught the same thing earlier.\n\n BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528\n Read of size 8 at addr ffff888105e4f078 by task swapper/4/0\n\n CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary)\n Call Trace:\n  \u003cIRQ\u003e\n dump_stack_lvl lib/dump_stack.c:122\n print_report mm/kasan/report.c:521\n kasan_report mm/kasan/report.c:634\n kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528\n kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605\n kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656\n kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684\n kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733\n __handle_irq_event_percpu kernel/irq/handle.c:158\n handle_irq_event kernel/irq/handle.c:210\n handle_edge_irq kernel/irq/chip.c:833\n __common_interrupt arch/x86/kernel/irq.c:296\n common_interrupt arch/x86/kernel/irq.c:286\n  \u003c/IRQ\u003e\n\nTx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq\nnumbers\u0027 generation that\u0027s not the case - we\u0027re free to calculate them as\nwould be more convenient, not taking tx max count into account. The only\ndownside is that the size of echo_skb[] should correspond to the max seq\nnumber (not tx max count), so in some situations a bit more memory would\nbe consumed than could be.\n\nThus make the size of the underlying echo_skb[] sufficient for the rounded\nmax tx value.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds index is derived from the driver\u0027s own monotonically increasing `tx_idx` transmit counter, so it is reached by locally transmitting CAN frames via an AF_CAN socket (`socket`/`bind`/`sendmsg`) on the kvaser_pciefd netdev. Data received from the CAN bus never indexes `echo_skb[]`, so no adjacent/network attacker controls the offset.\nAC:L - The overflow is fully deterministic \u2014 `seq = tx_idx \u0026 31` against a 17-entry array means the 18th frame sent lands out of bounds, with no race to win and no memory-layout condition needed to trigger it. Real Kvaser PCIe FD cards report a TX FIFO depth that makes `tx_max_count == 17`, which is exactly the case that rounds up to 32.\nPR:L - `can_create()` in net/can/af_can.c and `raw_sendmsg()` in net/can/raw.c contain no capability checks (only net/can/gw.c gates on CAP_NET_ADMIN), so any unprivileged local user can open a CAN_RAW socket and transmit. The interface being up is the normal operational state of a system fitted with a Kvaser CAN card, not an attacker-supplied precondition.\nUI:N - The attacker triggers the overflow entirely on their own by writing frames to a CAN socket; no victim action, mount, or file open is involved.\nS:U - The heap corruption occurs in kernel memory and is exploited within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - KASAN confirmed a slab-out-of-bounds *read* of 8 bytes at `can-\u003ecan.echo_skb[echo_idx]` beyond the end of the `net_device`+priv allocation; that adjacent-heap value is then treated as an `sk_buff *` and passed through `can_skb_ext_find()`/`netif_rx()`, exposing neighbouring kernel heap contents and enabling further disclosure.\nI:H - Indices 17\u201331 write past the end of the whole `kvzalloc_flex()` netdev allocation \u2014 a NULL store from `start_xmit()`, a live `sk_buff` pointer store from `can_put_echo_skb()`, and another NULL store from `__can_get_echo_skb()` \u2014 giving a controlled-offset out-of-bounds write into adjacent slab objects that is leverageable for control-flow hijacking.\nA:H - The out-of-bounds access is a KASAN-reported slab overflow reached from hard IRQ context; treating adjacent heap data as an `sk_buff` and passing it to `netif_rx()`/`dev_kfree_skb_any()` reliably produces an oops or panic, and a vmalloc-backed netdev allocation hits a guard page outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:27.874Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d8a054b6e6824a8b52c3977ebd38c9583a63efac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6550c9aa11e2f57f9cdaa6249cdd44d446be874"
        },
        {
          "url": "https://git.kernel.org/stable/c/54ec8b08216f3be2cc98b33633d3c8ea79749895"
        }
      ],
      "title": "can: kvaser_pciefd: refine error prone echo_skb_max handling logic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38224",
    "datePublished": "2025-07-04T13:37:39.305Z",
    "dateReserved": "2025-04-16T04:51:23.995Z",
    "dateUpdated": "2026-08-05T12:00:27.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:12.435Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "773e95c268b5d859f51f7547559734fd2a57660c",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "982beb7582c193544eb9c6083937ec5ac1c9d651",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "6aca3dad2145e864dfe4d1060f45eb1bac75dd58",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "80b971be4c37a4d23a7f1abc5ff33dc7733d649b",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "bc68bc3563344ccdc57d1961457cdeecab8f81ef",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "11f2d0e8be2b5e784ac45fa3da226492c3e506d8",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            },
            {
              "lessThan": "315dbdd7cdf6aa533829774caaf4d25f1fd20e73",
              "status": "affected",
              "version": "4941d472bf95b4345d6e38906fcf354e74afa311",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/virtio_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled value is the used-ring length written by the virtio backend (hypervisor/VMM, vhost-user daemon, VDUSE device, or vDPA hardware), not anything carried in received network packets, so a remote peer cannot reach it. The attack is delivered over the local paravirtual transport, matching kernel CNA precedent for virtio device-supplied-length bugs (CVE-2026-64456, CVE-2026-46123).\nAC:L - The backend fully and deterministically controls both `hdr-\u003enum_buffers` and the used-ring `len`, with no race to win and no memory-layout guessing required; a single crafted RX completion triggers it every time. XDP attachment is a target configuration the backend can observe via the guest\u0027s headroom/GSO renegotiation, not an uncontrollable condition.\nPR:N - The malicious backend needs no credentials, account, or capability inside the victim guest \u2014 it simply completes a receive buffer with a bogus length. This matches the PR:N scoring used for the equivalent virtio_bt and hwrng-virtio device-length CVEs.\nUI:N - Triggering requires only that the driver process an RX completion in NAPI/softirq context, which happens automatically. No victim action of any kind is needed.\nS:U - The vulnerable component and the impacted component are both the virtio_net driver\u0027s own kernel, and a host-to-guest attack does not gain the attacker authority it did not already hold. This is not a guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - Each malformed completion copies up to ~3.5 KB of adjacent kernel memory into the linearized packet, which the XDP program can then XDP_TX/XDP_REDIRECT back to the attacker or which reaches userspace via a socket, giving a repeatable kernel memory disclosure channel. The integer-overflow variant extends the read arbitrarily far past the source buffer.\nI:H - The `page_off + buflen + tailroom \u003e PAGE_SIZE` guard is defeated by unsigned wraparound (verified: `buflen = 0xFFFFFD5C` makes the sum evaluate to 0), so the memcpy writes gigabytes beyond the single-page destination, corrupting arbitrary kernel heap memory. That is an out-of-bounds write, not merely the out-of-bounds read named in the commit message.\nA:H - Reading past the end of the source page, or the multi-gigabyte memcpy from the overflow variant, faults in softirq context and oopses/panics the kernel, and is instantly reproducible under KASAN or DEBUG_PAGEALLOC. The wholesale kernel memory corruption makes a crash the expected outcome."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:26.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/773e95c268b5d859f51f7547559734fd2a57660c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddc8649d363141fb3371dd81a73e1cb4ef8ed1e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/982beb7582c193544eb9c6083937ec5ac1c9d651"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aca3dad2145e864dfe4d1060f45eb1bac75dd58"
        },
        {
          "url": "https://git.kernel.org/stable/c/80b971be4c37a4d23a7f1abc5ff33dc7733d649b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc68bc3563344ccdc57d1961457cdeecab8f81ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/11f2d0e8be2b5e784ac45fa3da226492c3e506d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/315dbdd7cdf6aa533829774caaf4d25f1fd20e73"
        }
      ],
      "title": "virtio-net: ensure the received length does not exceed allocated size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38375",
    "datePublished": "2025-07-25T12:53:17.629Z",
    "dateReserved": "2025-04-16T04:51:24.009Z",
    "dateUpdated": "2026-08-05T12:01:26.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:44.679Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22191359f8454b0be082c3b126f86bcbea0f1318",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "c29dd8336236a4deb75596b52d2dd16ccc4a380d",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "591c788d16046edb0220800bf1819554af5853ce",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "0643aa2468192a4d81326e8e76543854870b1ee2",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "f01e06930444cab289a8783017af9b64255bd103",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "2fd0c26bacd90ef26522bd3169000a4715bf151f",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "80a6b11862a7cfdf691e8f9faee89cfea219f098",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "6279846b9b2532e1b04559ef8bd0dec049f29383",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Forget ranges when refining tnum after JSET\n\nSyzbot reported a kernel warning due to a range invariant violation on\nthe following BPF program.\n\n  0: call bpf_get_netns_cookie\n  1: if r0 == 0 goto \u003cexit\u003e\n  2: if r0 \u0026 Oxffffffff goto \u003cexit\u003e\n\nThe issue is on the path where we fall through both jumps.\n\nThat path is unreachable at runtime: after insn 1, we know r0 != 0, but\nwith the sign extension on the jset, we would only fallthrough insn 2\nif r0 == 0. Unfortunately, is_branch_taken() isn\u0027t currently able to\nfigure this out, so the verifier walks all branches. The verifier then\nrefines the register bounds using the second condition and we end\nup with inconsistent bounds on this unreachable path:\n\n  1: if r0 == 0 goto \u003cexit\u003e\n    r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)\n  2: if r0 \u0026 0xffffffff goto \u003cexit\u003e\n    r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)\n    r0 after reg_bounds_sync:  u64=[0x1, 0] var_off=(0, 0)\n\nImproving the range refinement for JSET to cover all cases is tricky. We\nalso don\u0027t expect many users to rely on JSET given LLVM doesn\u0027t generate\nthose instructions. So instead of improving the range refinement for\nJSETs, Eduard suggested we forget the ranges whenever we\u0027re narrowing\ntnums after a JSET. This patch implements that approach."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:31.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22191359f8454b0be082c3b126f86bcbea0f1318"
        },
        {
          "url": "https://git.kernel.org/stable/c/c29dd8336236a4deb75596b52d2dd16ccc4a380d"
        },
        {
          "url": "https://git.kernel.org/stable/c/591c788d16046edb0220800bf1819554af5853ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/0643aa2468192a4d81326e8e76543854870b1ee2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f01e06930444cab289a8783017af9b64255bd103"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fd0c26bacd90ef26522bd3169000a4715bf151f"
        },
        {
          "url": "https://git.kernel.org/stable/c/80a6b11862a7cfdf691e8f9faee89cfea219f098"
        },
        {
          "url": "https://git.kernel.org/stable/c/6279846b9b2532e1b04559ef8bd0dec049f29383"
        }
      ],
      "title": "bpf: Forget ranges when refining tnum after JSET",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39748",
    "datePublished": "2025-09-11T16:52:20.534Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2026-07-14T12:42:44.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39964",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:19.988750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T17:53:37.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:43:10.378Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c",
            "include/crypto/if_alg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "7c4491b5644e3a3708f3dbd7591be0a570135b84",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "9aee87da5572b3a14075f501752e209801160d3d",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "45bcf60fe49b37daab1acee57b27211ad1574042",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c",
            "include/crypto/if_alg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx-\u003ewrite field that indiciates\nexclusive ownership for writing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the AF_ALG socket family via `socket()`/`bind()`/`sendmsg()`/`recvmsg()` syscalls, which requires local system access. There is no remote or adjacent-network path to `af_alg_sendmsg()`.\nAC:L - The attacker controls both sides of the race entirely \u2014 two of its own threads on a socket it owns \u2014 and can force writer A to park deterministically in `af_alg_wait_for_wmem()` by sizing `SO_SNDBUF` and filling it, then wake it on demand with its own `recvmsg()`. The error exit that leaves `cur == 0` is triggered at will with a deliberately faulting user buffer, so no condition is outside the attacker\u0027s control.\nPR:L - `alg_create()`, `alg_bind()` and `alg_setkey()` perform no capability checks whatsoever, so any unprivileged local user \u2014 including one inside a container or unprivileged user namespace \u2014 can open, bind and write to an AF_ALG skcipher/aead socket. The required modules are auto-loaded on demand via `MODULE_ALIAS_NETPROTO(AF_ALG)` and `request_module(\"algif-%s\")`.\nUI:N - The attacking process performs every step itself \u2014 socket creation, bind, and the two concurrent `sendmsg()` calls. No victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap objects (`struct af_alg_tsgl`/scatterlist and adjacent slab memory) within the same security authority. No hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The out-of-bounds scatterlist entry is fabricated from kernel list pointers and is subsequently handed to the cipher by `skcipher_recvmsg`/`aead_recvmsg` via `af_alg_pull_tsgl()`, so arbitrary kernel memory is encrypted/decrypted and returned to userspace. This yields a kernel memory disclosure primitive, not merely a pointer leak.\nI:H - `memcpy_from_msg(page_address(sg_page(sg)) + sg-\u003eoffset + sg-\u003elength, msg, len)` on the underflowed scatterlist writes attacker-controlled data of attacker-chosen length to an address derived from attacker-influenceable heap contents. Combined with heap grooming of the 4KB tsgl allocations, this is a controlled kernel write suitable for privilege escalation.\nA:H - Dereferencing `page_address(sg_page(sg))` on a bogus page_link, and the later `put_page()` on that fabricated page, reliably produce an oops/panic or page refcount corruption. Any unprivileged user can trigger this repeatedly, crashing the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:33.126Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84"
        },
        {
          "url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285"
        }
      ],
      "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39964",
    "datePublished": "2025-10-13T13:48:30.334Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:33.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}