Vulnerability-Lookup

CERTFR-2026-AVI-0696

Vulnerability from certfr_avis - Published: 2026-06-05 - Updated: 2026-06-05

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian bullseye versions antérieures 6.1.174-1~deb11u1
	Debian	Debian	Debian bullseye versions antérieures 5.10.257-1

References

Title

Publication Time

Tags

Bulletin de sécurité Debian LTS msg00051	2026-05-29	vendor-advisory
Bulletin de sécurité Debian LTS msg00052	2026-05-29	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Debian bullseye versions ant\u00e9rieures 6.1.174-1~deb11u1",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    },
    {
      "description": "Debian bullseye versions ant\u00e9rieures 5.10.257-1",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-43135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43135"
    },
    {
      "name": "CVE-2026-43078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43078"
    },
    {
      "name": "CVE-2026-43068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43068"
    },
    {
      "name": "CVE-2026-31770",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31770"
    },
    {
      "name": "CVE-2026-31658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31658"
    },
    {
      "name": "CVE-2026-23318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23318"
    },
    {
      "name": "CVE-2026-23368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23368"
    },
    {
      "name": "CVE-2026-43270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43270"
    },
    {
      "name": "CVE-2026-43227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43227"
    },
    {
      "name": "CVE-2026-31485",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31485"
    },
    {
      "name": "CVE-2026-43314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43314"
    },
    {
      "name": "CVE-2026-43373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43373"
    },
    {
      "name": "CVE-2026-43251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43251"
    },
    {
      "name": "CVE-2026-43211",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43211"
    },
    {
      "name": "CVE-2026-31402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31402"
    },
    {
      "name": "CVE-2025-40219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40219"
    },
    {
      "name": "CVE-2026-45852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45852"
    },
    {
      "name": "CVE-2026-31758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31758"
    },
    {
      "name": "CVE-2026-45856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45856"
    },
    {
      "name": "CVE-2026-23281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23281"
    },
    {
      "name": "CVE-2026-43168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43168"
    },
    {
      "name": "CVE-2026-43060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43060"
    },
    {
      "name": "CVE-2026-31416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31416"
    },
    {
      "name": "CVE-2025-39764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39764"
    },
    {
      "name": "CVE-2026-43241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43241"
    },
    {
      "name": "CVE-2026-43062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43062"
    },
    {
      "name": "CVE-2026-23293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23293"
    },
    {
      "name": "CVE-2026-23463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23463"
    },
    {
      "name": "CVE-2026-23227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23227"
    },
    {
      "name": "CVE-2026-45923",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45923"
    },
    {
      "name": "CVE-2026-31405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31405"
    },
    {
      "name": "CVE-2026-43136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43136"
    },
    {
      "name": "CVE-2026-43339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43339"
    },
    {
      "name": "CVE-2026-45868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45868"
    },
    {
      "name": "CVE-2026-31473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31473"
    },
    {
      "name": "CVE-2026-31550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31550"
    },
    {
      "name": "CVE-2026-23290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23290"
    },
    {
      "name": "CVE-2026-31752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31752"
    },
    {
      "name": "CVE-2026-31787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31787"
    },
    {
      "name": "CVE-2026-43202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43202"
    },
    {
      "name": "CVE-2026-23303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23303"
    },
    {
      "name": "CVE-2026-43011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43011"
    },
    {
      "name": "CVE-2026-43132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43132"
    },
    {
      "name": "CVE-2026-31396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31396"
    },
    {
      "name": "CVE-2026-31680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31680"
    },
    {
      "name": "CVE-2026-43163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43163"
    },
    {
      "name": "CVE-2026-31738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31738"
    },
    {
      "name": "CVE-2026-43411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43411"
    },
    {
      "name": "CVE-2026-31751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31751"
    },
    {
      "name": "CVE-2026-43429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43429"
    },
    {
      "name": "CVE-2026-43382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43382"
    },
    {
      "name": "CVE-2026-23439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23439"
    },
    {
      "name": "CVE-2026-23253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23253"
    },
    {
      "name": "CVE-2026-31721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31721"
    },
    {
      "name": "CVE-2026-23434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23434"
    },
    {
      "name": "CVE-2026-43014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43014"
    },
    {
      "name": "CVE-2026-43139",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43139"
    },
    {
      "name": "CVE-2026-45873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45873"
    },
    {
      "name": "CVE-2026-31447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31447"
    },
    {
      "name": "CVE-2026-45870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45870"
    },
    {
      "name": "CVE-2026-43445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43445"
    },
    {
      "name": "CVE-2026-43387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43387"
    },
    {
      "name": "CVE-2026-43028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43028"
    },
    {
      "name": "CVE-2026-45871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45871"
    },
    {
      "name": "CVE-2026-43475",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43475"
    },
    {
      "name": "CVE-2026-23304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23304"
    },
    {
      "name": "CVE-2026-31683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31683"
    },
    {
      "name": "CVE-2026-23357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23357"
    },
    {
      "name": "CVE-2026-45860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45860"
    },
    {
      "name": "CVE-2026-31524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31524"
    },
    {
      "name": "CVE-2026-43231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43231"
    },
    {
      "name": "CVE-2026-31668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31668"
    },
    {
      "name": "CVE-2026-31546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31546"
    },
    {
      "name": "CVE-2026-45956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45956"
    },
    {
      "name": "CVE-2026-43047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43047"
    },
    {
      "name": "CVE-2026-43432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43432"
    },
    {
      "name": "CVE-2026-45866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45866"
    },
    {
      "name": "CVE-2026-31786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31786"
    },
    {
      "name": "CVE-2026-31545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31545"
    },
    {
      "name": "CVE-2026-23456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23456"
    },
    {
      "name": "CVE-2026-43458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43458"
    },
    {
      "name": "CVE-2026-43450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43450"
    },
    {
      "name": "CVE-2026-31510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31510"
    },
    {
      "name": "CVE-2026-23457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23457"
    },
    {
      "name": "CVE-2026-43503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43503"
    },
    {
      "name": "CVE-2026-43069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43069"
    },
    {
      "name": "CVE-2026-43425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43425"
    },
    {
      "name": "CVE-2026-31659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31659"
    },
    {
      "name": "CVE-2026-43480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43480"
    },
    {
      "name": "CVE-2026-43268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43268"
    },
    {
      "name": "CVE-2026-43426",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43426"
    },
    {
      "name": "CVE-2026-43030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43030"
    },
    {
      "name": "CVE-2026-45914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45914"
    },
    {
      "name": "CVE-2026-45912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45912"
    },
    {
      "name": "CVE-2026-43383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43383"
    },
    {
      "name": "CVE-2026-43334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43334"
    },
    {
      "name": "CVE-2026-23391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23391"
    },
    {
      "name": "CVE-2026-31415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31415"
    },
    {
      "name": "CVE-2026-45869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45869"
    },
    {
      "name": "CVE-2026-23462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23462"
    },
    {
      "name": "CVE-2026-23273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23273"
    },
    {
      "name": "CVE-2026-23372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23372"
    },
    {
      "name": "CVE-2026-45919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45919"
    },
    {
      "name": "CVE-2026-45862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45862"
    },
    {
      "name": "CVE-2026-46174",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46174"
    },
    {
      "name": "CVE-2026-45857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45857"
    },
    {
      "name": "CVE-2026-45848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45848"
    },
    {
      "name": "CVE-2026-43327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43327"
    },
    {
      "name": "CVE-2026-31494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31494"
    },
    {
      "name": "CVE-2026-43381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43381"
    },
    {
      "name": "CVE-2026-31763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31763"
    },
    {
      "name": "CVE-2026-23279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23279"
    },
    {
      "name": "CVE-2026-31670",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31670"
    },
    {
      "name": "CVE-2026-31422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31422"
    },
    {
      "name": "CVE-2025-71304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71304"
    },
    {
      "name": "CVE-2026-23286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23286"
    },
    {
      "name": "CVE-2026-43232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43232"
    },
    {
      "name": "CVE-2026-23298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23298"
    },
    {
      "name": "CVE-2026-31469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31469"
    },
    {
      "name": "CVE-2026-45867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45867"
    },
    {
      "name": "CVE-2026-43264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43264"
    },
    {
      "name": "CVE-2026-31498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31498"
    },
    {
      "name": "CVE-2026-45879",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45879"
    },
    {
      "name": "CVE-2026-45883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45883"
    },
    {
      "name": "CVE-2026-43336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43336"
    },
    {
      "name": "CVE-2026-43269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43269"
    },
    {
      "name": "CVE-2026-31418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31418"
    },
    {
      "name": "CVE-2026-45981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45981"
    },
    {
      "name": "CVE-2026-43466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43466"
    },
    {
      "name": "CVE-2026-31427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31427"
    },
    {
      "name": "CVE-2026-31555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31555"
    },
    {
      "name": "CVE-2026-43439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43439"
    },
    {
      "name": "CVE-2026-43183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43183"
    },
    {
      "name": "CVE-2026-31515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31515"
    },
    {
      "name": "CVE-2026-31661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31661"
    },
    {
      "name": "CVE-2026-43452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43452"
    },
    {
      "name": "CVE-2026-31737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31737"
    },
    {
      "name": "CVE-2026-45960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45960"
    },
    {
      "name": "CVE-2026-43043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43043"
    },
    {
      "name": "CVE-2026-43140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43140"
    },
    {
      "name": "CVE-2026-43223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43223"
    },
    {
      "name": "CVE-2026-23396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23396"
    },
    {
      "name": "CVE-2026-31423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31423"
    },
    {
      "name": "CVE-2026-43051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43051"
    },
    {
      "name": "CVE-2026-31759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31759"
    },
    {
      "name": "CVE-2026-43246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43246"
    },
    {
      "name": "CVE-2026-31781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31781"
    },
    {
      "name": "CVE-2026-43449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43449"
    },
    {
      "name": "CVE-2026-45948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45948"
    },
    {
      "name": "CVE-2026-43147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43147"
    },
    {
      "name": "CVE-2026-31523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31523"
    },
    {
      "name": "CVE-2026-43459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43459"
    },
    {
      "name": "CVE-2026-31450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31450"
    },
    {
      "name": "CVE-2026-31671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31671"
    },
    {
      "name": "CVE-2026-31749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31749"
    },
    {
      "name": "CVE-2026-43328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43328"
    },
    {
      "name": "CVE-2026-43024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43024"
    },
    {
      "name": "CVE-2026-45985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45985"
    },
    {
      "name": "CVE-2026-43207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43207"
    },
    {
      "name": "CVE-2026-23352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23352"
    },
    {
      "name": "CVE-2026-31720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31720"
    },
    {
      "name": "CVE-2026-31748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31748"
    },
    {
      "name": "CVE-2026-43077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43077"
    },
    {
      "name": "CVE-2026-43472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43472"
    },
    {
      "name": "CVE-2026-23367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23367"
    },
    {
      "name": "CVE-2026-31628",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31628"
    },
    {
      "name": "CVE-2026-43407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43407"
    },
    {
      "name": "CVE-2026-45899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45899"
    },
    {
      "name": "CVE-2026-31662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31662"
    },
    {
      "name": "CVE-2026-43026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43026"
    },
    {
      "name": "CVE-2026-43430",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43430"
    },
    {
      "name": "CVE-2026-43437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43437"
    },
    {
      "name": "CVE-2026-45920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45920"
    },
    {
      "name": "CVE-2026-43184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43184"
    },
    {
      "name": "CVE-2026-23446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23446"
    },
    {
      "name": "CVE-2026-46300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46300"
    },
    {
      "name": "CVE-2026-43035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43035"
    },
    {
      "name": "CVE-2026-31665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31665"
    },
    {
      "name": "CVE-2026-23300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23300"
    },
    {
      "name": "CVE-2026-45941",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45941"
    },
    {
      "name": "CVE-2026-43261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43261"
    },
    {
      "name": "CVE-2026-31391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31391"
    },
    {
      "name": "CVE-2026-43158",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43158"
    },
    {
      "name": "CVE-2026-31672",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31672"
    },
    {
      "name": "CVE-2026-31780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31780"
    },
    {
      "name": "CVE-2026-43342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43342"
    },
    {
      "name": "CVE-2026-23243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23243"
    },
    {
      "name": "CVE-2026-43357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43357"
    },
    {
      "name": "CVE-2026-43061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43061"
    },
    {
      "name": "CVE-2026-43453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43453"
    },
    {
      "name": "CVE-2026-43032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43032"
    },
    {
      "name": "CVE-2026-45954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45954"
    },
    {
      "name": "CVE-2026-23362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23362"
    },
    {
      "name": "CVE-2026-23379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23379"
    },
    {
      "name": "CVE-2026-45984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45984"
    },
    {
      "name": "CVE-2026-43427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43427"
    },
    {
      "name": "CVE-2026-31421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31421"
    },
    {
      "name": "CVE-2026-23381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23381"
    },
    {
      "name": "CVE-2026-31518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31518"
    },
    {
      "name": "CVE-2026-43296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43296"
    },
    {
      "name": "CVE-2026-31660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31660"
    },
    {
      "name": "CVE-2026-23245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23245"
    },
    {
      "name": "CVE-2026-45916",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45916"
    },
    {
      "name": "CVE-2026-31728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31728"
    },
    {
      "name": "CVE-2026-31403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31403"
    },
    {
      "name": "CVE-2026-31400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31400"
    },
    {
      "name": "CVE-2026-31512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31512"
    },
    {
      "name": "CVE-2026-43124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43124"
    },
    {
      "name": "CVE-2026-43141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43141"
    },
    {
      "name": "CVE-2026-31726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31726"
    },
    {
      "name": "CVE-2026-31504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31504"
    },
    {
      "name": "CVE-2026-43370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43370"
    },
    {
      "name": "CVE-2026-31773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31773"
    },
    {
      "name": "CVE-2026-43134",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43134"
    },
    {
      "name": "CVE-2026-23242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23242"
    },
    {
      "name": "CVE-2026-43015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43015"
    },
    {
      "name": "CVE-2026-31509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31509"
    },
    {
      "name": "CVE-2025-71292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71292"
    },
    {
      "name": "CVE-2026-43066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43066"
    },
    {
      "name": "CVE-2026-43242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43242"
    },
    {
      "name": "CVE-2026-31679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31679"
    },
    {
      "name": "CVE-2026-45970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45970"
    },
    {
      "name": "CVE-2026-23274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23274"
    },
    {
      "name": "CVE-2026-43020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43020"
    },
    {
      "name": "CVE-2026-31417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31417"
    },
    {
      "name": "CVE-2026-43041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43041"
    },
    {
      "name": "CVE-2026-31761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31761"
    },
    {
      "name": "CVE-2026-31466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31466"
    },
    {
      "name": "CVE-2024-56584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56584"
    },
    {
      "name": "CVE-2026-45958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45958"
    },
    {
      "name": "CVE-2026-43257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43257"
    },
    {
      "name": "CVE-2026-31778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31778"
    },
    {
      "name": "CVE-2026-43180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43180"
    },
    {
      "name": "CVE-2026-43196",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43196"
    },
    {
      "name": "CVE-2026-45968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45968"
    },
    {
      "name": "CVE-2026-43040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43040"
    },
    {
      "name": "CVE-2026-43152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43152"
    },
    {
      "name": "CVE-2026-43287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43287"
    },
    {
      "name": "CVE-2026-31552",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31552"
    },
    {
      "name": "CVE-2026-43428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43428"
    },
    {
      "name": "CVE-2026-23397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23397"
    },
    {
      "name": "CVE-2026-43206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43206"
    },
    {
      "name": "CVE-2026-23452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23452"
    },
    {
      "name": "CVE-2026-43273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43273"
    },
    {
      "name": "CVE-2026-23474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23474"
    },
    {
      "name": "CVE-2026-43190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43190"
    },
    {
      "name": "CVE-2026-45885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45885"
    },
    {
      "name": "CVE-2026-43226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43226"
    },
    {
      "name": "CVE-2026-23336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23336"
    },
    {
      "name": "CVE-2026-43355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43355"
    },
    {
      "name": "CVE-2026-31497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31497"
    },
    {
      "name": "CVE-2026-43451",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43451"
    },
    {
      "name": "CVE-2026-31682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31682"
    },
    {
      "name": "CVE-2026-31570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31570"
    },
    {
      "name": "CVE-2026-23289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23289"
    },
    {
      "name": "CVE-2026-23277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23277"
    },
    {
      "name": "CVE-2026-31399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31399"
    },
    {
      "name": "CVE-2026-45964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45964"
    },
    {
      "name": "CVE-2026-43343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43343"
    },
    {
      "name": "CVE-2026-43289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43289"
    },
    {
      "name": "CVE-2026-43187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43187"
    },
    {
      "name": "CVE-2026-23455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23455"
    },
    {
      "name": "CVE-2026-45936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45936"
    },
    {
      "name": "CVE-2026-45978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45978"
    },
    {
      "name": "CVE-2026-43159",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43159"
    },
    {
      "name": "CVE-2026-31495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31495"
    },
    {
      "name": "CVE-2026-31507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31507"
    },
    {
      "name": "CVE-2026-43149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43149"
    },
    {
      "name": "CVE-2026-31762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31762"
    },
    {
      "name": "CVE-2026-43236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43236"
    },
    {
      "name": "CVE-2026-31788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31788"
    },
    {
      "name": "CVE-2026-31411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31411"
    },
    {
      "name": "CVE-2026-31428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31428"
    },
    {
      "name": "CVE-2026-23420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23420"
    },
    {
      "name": "CVE-2026-23388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23388"
    },
    {
      "name": "CVE-2025-39748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39748"
    },
    {
      "name": "CVE-2026-43277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43277"
    },
    {
      "name": "CVE-2026-43386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43386"
    },
    {
      "name": "CVE-2026-43037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43037"
    },
    {
      "name": "CVE-2026-43266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43266"
    },
    {
      "name": "CVE-2026-23458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23458"
    },
    {
      "name": "CVE-2026-31649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31649"
    },
    {
      "name": "CVE-2026-31674",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31674"
    },
    {
      "name": "CVE-2026-31393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31393"
    },
    {
      "name": "CVE-2026-43420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43420"
    },
    {
      "name": "CVE-2026-43233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43233"
    },
    {
      "name": "CVE-2026-43027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43027"
    },
    {
      "name": "CVE-2026-45904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45904"
    },
    {
      "name": "CVE-2025-68206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68206"
    },
    {
      "name": "CVE-2026-43295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43295"
    },
    {
      "name": "CVE-2026-23339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23339"
    },
    {
      "name": "CVE-2026-23112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23112"
    },
    {
      "name": "CVE-2026-23460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23460"
    },
    {
      "name": "CVE-2026-23395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23395"
    },
    {
      "name": "CVE-2026-31651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31651"
    },
    {
      "name": "CVE-2026-23100",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23100"
    },
    {
      "name": "CVE-2026-31747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31747"
    },
    {
      "name": "CVE-2026-31455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31455"
    },
    {
      "name": "CVE-2026-43316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43316"
    },
    {
      "name": "CVE-2026-43340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43340"
    },
    {
      "name": "CVE-2026-23291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23291"
    },
    {
      "name": "CVE-2026-43156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43156"
    },
    {
      "name": "CVE-2026-43194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43194"
    },
    {
      "name": "CVE-2026-23382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23382"
    },
    {
      "name": "CVE-2026-43230",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43230"
    },
    {
      "name": "CVE-2026-43209",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43209"
    },
    {
      "name": "CVE-2025-71274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71274"
    },
    {
      "name": "CVE-2026-43171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43171"
    },
    {
      "name": "CVE-2026-43424",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43424"
    },
    {
      "name": "CVE-2025-40261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40261"
    },
    {
      "name": "CVE-2026-23312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23312"
    },
    {
      "name": "CVE-2026-31508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31508"
    },
    {
      "name": "CVE-2026-23365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23365"
    },
    {
      "name": "CVE-2026-45983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45983"
    },
    {
      "name": "CVE-2026-31424",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31424"
    },
    {
      "name": "CVE-2026-46028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46028"
    },
    {
      "name": "CVE-2026-23356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23356"
    },
    {
      "name": "CVE-2026-45875",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45875"
    },
    {
      "name": "CVE-2026-23307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23307"
    },
    {
      "name": "CVE-2026-43038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43038"
    },
    {
      "name": "CVE-2026-45974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45974"
    },
    {
      "name": "CVE-2026-45965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45965"
    },
    {
      "name": "CVE-2026-43218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43218"
    },
    {
      "name": "CVE-2026-43363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43363"
    },
    {
      "name": "CVE-2026-45915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45915"
    },
    {
      "name": "CVE-2026-31454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31454"
    },
    {
      "name": "CVE-2026-43130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43130"
    },
    {
      "name": "CVE-2026-31452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31452"
    },
    {
      "name": "CVE-2026-23398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23398"
    },
    {
      "name": "CVE-2026-31425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31425"
    },
    {
      "name": "CVE-2026-45890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45890"
    },
    {
      "name": "CVE-2026-43255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43255"
    },
    {
      "name": "CVE-2026-43283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43283"
    },
    {
      "name": "CVE-2026-23351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23351"
    },
    {
      "name": "CVE-2026-43050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43050"
    },
    {
      "name": "CVE-2026-43203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43203"
    },
    {
      "name": "CVE-2026-31667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31667"
    }
  ],
  "initial_release_date": "2026-06-05T00:00:00",
  "last_revision_date": "2026-06-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0696",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
  "vendor_advisories": [
    {
      "published_at": "2026-05-29",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00051",
      "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00051.html"
    },
    {
      "published_at": "2026-05-29",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00052",
      "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00052.html"
    }
  ]
}

CVE-2024-56584 (GCVE-0-2024-56584)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:50 – Updated: 2026-05-11 20:55

Title

io_uring/tctx: work around xa_store() allocation error issue

Summary

In the Linux kernel, the following vulnerability has been resolved: io_uring/tctx: work around xa_store() allocation error issue syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.

Severity

No CVSS data available.

Assigner

Linux

References

7 references

URL	Tags
https://git.kernel.org/stable/c/e05c070b401f6365c…
https://git.kernel.org/stable/c/3a84fa78471099096…
https://git.kernel.org/stable/c/94ad56f61b873ffee…
https://git.kernel.org/stable/c/42882b583095dcf74…
https://git.kernel.org/stable/c/d5b2ddf1f90c7248e…
https://git.kernel.org/stable/c/7eb75ce7527129d7f…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2b188cc1bb857a9d4701ae59aa7768b5124e262e , < e05c070b401f6365c503e2b59f091331965c4fb9 (git) Affected: 2b188cc1bb857a9d4701ae59aa7768b5124e262e , < 3a84fa784710990964c1e35df743851ab2863898 (git) Affected: 2b188cc1bb857a9d4701ae59aa7768b5124e262e , < 94ad56f61b873ffeebcc620d451eacfbdf9d40f0 (git) Affected: 2b188cc1bb857a9d4701ae59aa7768b5124e262e , < 42882b583095dcf747da6e3af1daeff40e27033e (git) Affected: 2b188cc1bb857a9d4701ae59aa7768b5124e262e , < d5b2ddf1f90c7248eff9630b95895c8950f2f36d (git) Affected: 2b188cc1bb857a9d4701ae59aa7768b5124e262e , < 7eb75ce7527129d7f1fee6951566af409a37a1c4 (git)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:01.079Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/tctx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e05c070b401f6365c503e2b59f091331965c4fb9",
              "status": "affected",
              "version": "2b188cc1bb857a9d4701ae59aa7768b5124e262e",
              "versionType": "git"
            },
            {
              "lessThan": "3a84fa784710990964c1e35df743851ab2863898",
              "status": "affected",
              "version": "2b188cc1bb857a9d4701ae59aa7768b5124e262e",
              "versionType": "git"
            },
            {
              "lessThan": "94ad56f61b873ffeebcc620d451eacfbdf9d40f0",
              "status": "affected",
              "version": "2b188cc1bb857a9d4701ae59aa7768b5124e262e",
              "versionType": "git"
            },
            {
              "lessThan": "42882b583095dcf747da6e3af1daeff40e27033e",
              "status": "affected",
              "version": "2b188cc1bb857a9d4701ae59aa7768b5124e262e",
              "versionType": "git"
            },
            {
              "lessThan": "d5b2ddf1f90c7248eff9630b95895c8950f2f36d",
              "status": "affected",
              "version": "2b188cc1bb857a9d4701ae59aa7768b5124e262e",
              "versionType": "git"
            },
            {
              "lessThan": "7eb75ce7527129d7f1fee6951566af409a37a1c4",
              "status": "affected",
              "version": "2b188cc1bb857a9d4701ae59aa7768b5124e262e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/tctx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/tctx: work around xa_store() allocation error issue\n\nsyzbot triggered the following WARN_ON:\n\nWARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51\n\nwhich is the\n\nWARN_ON_ONCE(!xa_empty(\u0026tctx-\u003exa));\n\nsanity check in __io_uring_free() when a io_uring_task is going through\nits final put. The syzbot test case includes injecting memory allocation\nfailures, and it very much looks like xa_store() can fail one of its\nmemory allocations and end up with -\u003ehead being non-NULL even though no\nentries exist in the xarray.\n\nUntil this issue gets sorted out, work around it by attempting to\niterate entries in our xarray, and WARN_ON_ONCE() if one is found."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:55:17.165Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e05c070b401f6365c503e2b59f091331965c4fb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a84fa784710990964c1e35df743851ab2863898"
        },
        {
          "url": "https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4"
        }
      ],
      "title": "io_uring/tctx: work around xa_store() allocation error issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56584",
    "datePublished": "2024-12-27T14:50:52.735Z",
    "dateReserved": "2024-12-27T14:03:06.001Z",
    "dateUpdated": "2026-05-11T20:55:17.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39748 (GCVE-0-2025-39748)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:52 – Updated: 2026-05-11 21:35

Title

bpf: Forget ranges when refining tnum after JSET

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 goto <exit> 2: if r0 & Oxffffffff goto <exit> The issue is on the path where we fall through both jumps. That path is unreachable at runtime: after insn 1, we know r0 != 0, but with the sign extension on the jset, we would only fallthrough insn 2 if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to figure this out, so the verifier walks all branches. The verifier then refines the register bounds using the second condition and we end up with inconsistent bounds on this unreachable path: 1: if r0 == 0 goto <exit> r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff) 2: if r0 & 0xffffffff goto <exit> r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0) r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0) Improving the range refinement for JSET to cover all cases is tricky. We also don't expect many users to rely on JSET given LLVM doesn't generate those instructions. So instead of improving the range refinement for JSETs, Eduard suggested we forget the ranges whenever we're narrowing tnums after a JSET. This patch implements that approach.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/22191359f8454b0be…
https://git.kernel.org/stable/c/c29dd8336236a4deb…
https://git.kernel.org/stable/c/591c788d16046edb0…
https://git.kernel.org/stable/c/0643aa2468192a4d8…
https://git.kernel.org/stable/c/f01e06930444cab28…
https://git.kernel.org/stable/c/2fd0c26bacd90ef26…
https://git.kernel.org/stable/c/80a6b11862a7cfdf6…
https://git.kernel.org/stable/c/6279846b9b2532e1b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < 22191359f8454b0be082c3b126f86bcbea0f1318 (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < c29dd8336236a4deb75596b52d2dd16ccc4a380d (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < 591c788d16046edb0220800bf1819554af5853ce (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < 0643aa2468192a4d81326e8e76543854870b1ee2 (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < f01e06930444cab289a8783017af9b64255bd103 (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < 2fd0c26bacd90ef26522bd3169000a4715bf151f (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < 80a6b11862a7cfdf691e8f9faee89cfea219f098 (git) Affected: 960ea056561a08e2b837b2f02d22c53226414a84 , < 6279846b9b2532e1b04559ef8bd0dec049f29383 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.43 , ≤ 6.12.* (semver) Unaffected: 6.15.11 , ≤ 6.15.* (semver) Unaffected: 6.16.2 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22191359f8454b0be082c3b126f86bcbea0f1318",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "c29dd8336236a4deb75596b52d2dd16ccc4a380d",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "591c788d16046edb0220800bf1819554af5853ce",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "0643aa2468192a4d81326e8e76543854870b1ee2",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "f01e06930444cab289a8783017af9b64255bd103",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "2fd0c26bacd90ef26522bd3169000a4715bf151f",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "80a6b11862a7cfdf691e8f9faee89cfea219f098",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            },
            {
              "lessThan": "6279846b9b2532e1b04559ef8bd0dec049f29383",
              "status": "affected",
              "version": "960ea056561a08e2b837b2f02d22c53226414a84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Forget ranges when refining tnum after JSET\n\nSyzbot reported a kernel warning due to a range invariant violation on\nthe following BPF program.\n\n  0: call bpf_get_netns_cookie\n  1: if r0 == 0 goto \u003cexit\u003e\n  2: if r0 \u0026 Oxffffffff goto \u003cexit\u003e\n\nThe issue is on the path where we fall through both jumps.\n\nThat path is unreachable at runtime: after insn 1, we know r0 != 0, but\nwith the sign extension on the jset, we would only fallthrough insn 2\nif r0 == 0. Unfortunately, is_branch_taken() isn\u0027t currently able to\nfigure this out, so the verifier walks all branches. The verifier then\nrefines the register bounds using the second condition and we end\nup with inconsistent bounds on this unreachable path:\n\n  1: if r0 == 0 goto \u003cexit\u003e\n    r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)\n  2: if r0 \u0026 0xffffffff goto \u003cexit\u003e\n    r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)\n    r0 after reg_bounds_sync:  u64=[0x1, 0] var_off=(0, 0)\n\nImproving the range refinement for JSET to cover all cases is tricky. We\nalso don\u0027t expect many users to rely on JSET given LLVM doesn\u0027t generate\nthose instructions. So instead of improving the range refinement for\nJSETs, Eduard suggested we forget the ranges whenever we\u0027re narrowing\ntnums after a JSET. This patch implements that approach."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:31.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22191359f8454b0be082c3b126f86bcbea0f1318"
        },
        {
          "url": "https://git.kernel.org/stable/c/c29dd8336236a4deb75596b52d2dd16ccc4a380d"
        },
        {
          "url": "https://git.kernel.org/stable/c/591c788d16046edb0220800bf1819554af5853ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/0643aa2468192a4d81326e8e76543854870b1ee2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f01e06930444cab289a8783017af9b64255bd103"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fd0c26bacd90ef26522bd3169000a4715bf151f"
        },
        {
          "url": "https://git.kernel.org/stable/c/80a6b11862a7cfdf691e8f9faee89cfea219f098"
        },
        {
          "url": "https://git.kernel.org/stable/c/6279846b9b2532e1b04559ef8bd0dec049f29383"
        }
      ],
      "title": "bpf: Forget ranges when refining tnum after JSET",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39748",
    "datePublished": "2025-09-11T16:52:20.534Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2026-05-11T21:35:31.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39764 (GCVE-0-2025-39764)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:52 – Updated: 2026-05-11 21:35

Title

netfilter: ctnetlink: remove refcounting in expectation dumpers

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak.

Severity

No CVSS data available.

Assigner

Linux

References

7 references

URL	Tags
https://git.kernel.org/stable/c/b05500444b8eb9764…
https://git.kernel.org/stable/c/bada48ad5b0590e31…
https://git.kernel.org/stable/c/64b7684042246e323…
https://git.kernel.org/stable/c/9e5021a906532ca16…
https://git.kernel.org/stable/c/078d33c95bf534d37…
https://git.kernel.org/stable/c/a4d634ded4d3d400f…
https://git.kernel.org/stable/c/1492e3dcb2be3aa46…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < b05500444b8eb97644efdd180839a04a706be97c (git) Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < bada48ad5b0590e318d0f79636ff62a2ef9f4955 (git) Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < 64b7684042246e3238464c66894e30ba30c7e851 (git) Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < 9e5021a906532ca16e2aac69c0607711e1c70b1f (git) Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < 078d33c95bf534d37aa04269d1ae6158e20082d5 (git) Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < a4d634ded4d3d400f115d84f654f316f249531c9 (git) Affected: cf6994c2b9812a9f02b99e89df411ffc5db9c779 , < 1492e3dcb2be3aa46d1963da96aa9593e4e4db5a (git)
Linux	Linux	Affected: 2.6.23 Unaffected: 0 , < 2.6.23 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.16.2 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b05500444b8eb97644efdd180839a04a706be97c",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            },
            {
              "lessThan": "bada48ad5b0590e318d0f79636ff62a2ef9f4955",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            },
            {
              "lessThan": "64b7684042246e3238464c66894e30ba30c7e851",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            },
            {
              "lessThan": "9e5021a906532ca16e2aac69c0607711e1c70b1f",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            },
            {
              "lessThan": "078d33c95bf534d37aa04269d1ae6158e20082d5",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            },
            {
              "lessThan": "a4d634ded4d3d400f115d84f654f316f249531c9",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            },
            {
              "lessThan": "1492e3dcb2be3aa46d1963da96aa9593e4e4db5a",
              "status": "affected",
              "version": "cf6994c2b9812a9f02b99e89df411ffc5db9c779",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "lessThan": "2.6.23",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n  if (!refcount_inc_not_zero(\u0026exp-\u003euse))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:48.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b05500444b8eb97644efdd180839a04a706be97c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bada48ad5b0590e318d0f79636ff62a2ef9f4955"
        },
        {
          "url": "https://git.kernel.org/stable/c/64b7684042246e3238464c66894e30ba30c7e851"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e5021a906532ca16e2aac69c0607711e1c70b1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/078d33c95bf534d37aa04269d1ae6158e20082d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4d634ded4d3d400f115d84f654f316f249531c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1492e3dcb2be3aa46d1963da96aa9593e4e4db5a"
        }
      ],
      "title": "netfilter: ctnetlink: remove refcounting in expectation dumpers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39764",
    "datePublished": "2025-09-11T16:52:32.060Z",
    "dateReserved": "2025-04-16T07:20:57.126Z",
    "dateUpdated": "2026-05-11T21:35:48.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40219 (GCVE-0-2025-40219)

Vulnerability from cvelistv5 – Published: 2025-12-04 14:50 – Updated: 2026-05-11 21:45

Title

PCI/IOV: Fix race between SR-IOV enable/disable and hotplug

Summary

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock was also taken in sriov_add_vfs() to protect addition of VFs. This approach however causes deadlock on trying to remove PFs with SR-IOV enabled because PFs disable SR-IOV during removal and this removal happens under the PCI rescan/remove lock. So the original fix had to be reverted. Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs hotplug higher up in the callchain by taking the lock in sriov_numvfs_store() before calling into the driver's sriov_configure() callback.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/3cddde484471c602b…
https://git.kernel.org/stable/c/d7673ac466eca37ec…
https://git.kernel.org/stable/c/7c37920c96b85ef42…
https://git.kernel.org/stable/c/1047ca2d816994f31…
https://git.kernel.org/stable/c/97c18f074ff1c12d0…
https://git.kernel.org/stable/c/bea1d373098b22d71…
https://git.kernel.org/stable/c/f3015627b6e9ddf85…
https://git.kernel.org/stable/c/a5338e365c4559d7b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 3cddde484471c602bea04e6f384819d336a1ff84 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 7c37920c96b85ef4255a7acc795e99e63dd38d59 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 1047ca2d816994f31e1475e63e0c0b7825599747 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < 97c18f074ff1c12d016a0753072a3afdfa0b9611 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < bea1d373098b22d7142da48750ce5526096425bc (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < f3015627b6e9ddf85cfeaf42405b3c194dde2c36 (git) Affected: 18f9e9d150fccfa747875df6f0a9f606740762b3 , < a5338e365c4559d7b4d7356116b0eb95b12e08d5 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3cddde484471c602bea04e6f384819d336a1ff84",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "7c37920c96b85ef4255a7acc795e99e63dd38d59",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "1047ca2d816994f31e1475e63e0c0b7825599747",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "97c18f074ff1c12d016a0753072a3afdfa0b9611",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "bea1d373098b22d7142da48750ce5526096425bc",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "f3015627b6e9ddf85cfeaf42405b3c194dde2c36",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            },
            {
              "lessThan": "a5338e365c4559d7b4d7356116b0eb95b12e08d5",
              "status": "affected",
              "version": "18f9e9d150fccfa747875df6f0a9f606740762b3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Fix race between SR-IOV enable/disable and hotplug\n\nCommit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking when\nenabling/disabling SR-IOV\") tried to fix a race between the VF removal\ninside sriov_del_vfs() and concurrent hot unplug by taking the PCI\nrescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock\nwas also taken in sriov_add_vfs() to protect addition of VFs.\n\nThis approach however causes deadlock on trying to remove PFs with SR-IOV\nenabled because PFs disable SR-IOV during removal and this removal happens\nunder the PCI rescan/remove lock. So the original fix had to be reverted.\n\nInstead of taking the PCI rescan/remove lock in sriov_add_vfs() and\nsriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs\nhotplug higher up in the callchain by taking the lock in\nsriov_numvfs_store() before calling into the driver\u0027s sriov_configure()\ncallback."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:45:05.429Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3cddde484471c602bea04e6f384819d336a1ff84"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c37920c96b85ef4255a7acc795e99e63dd38d59"
        },
        {
          "url": "https://git.kernel.org/stable/c/1047ca2d816994f31e1475e63e0c0b7825599747"
        },
        {
          "url": "https://git.kernel.org/stable/c/97c18f074ff1c12d016a0753072a3afdfa0b9611"
        },
        {
          "url": "https://git.kernel.org/stable/c/bea1d373098b22d7142da48750ce5526096425bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3015627b6e9ddf85cfeaf42405b3c194dde2c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5338e365c4559d7b4d7356116b0eb95b12e08d5"
        }
      ],
      "title": "PCI/IOV: Fix race between SR-IOV enable/disable and hotplug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40219",
    "datePublished": "2025-12-04T14:50:42.996Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-05-11T21:45:05.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40261 (GCVE-0-2025-40261)

Vulnerability from cvelistv5 – Published: 2025-12-04 16:08 – Updated: 2026-06-02 13:00

Title

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

Summary

In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[ cut here ]------------ [ 1135.922336] kernel BUG at lib/list_debug.c:52! [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 [ 1135.950969] Workqueue: 0x0 (nvme-wq) [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 [ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 [ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100 [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0 [ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 [ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 [ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1136.055910] PKRU: 55555554 [ 1136.058623] Call Trace: [ 1136.061074] <TASK> [ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.071898] ? move_linked_works+0x4a/0xa0 [ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.081744] ? __die_body.cold+0x8/0x12 [ 1136.085584] ? die+0x2e/0x50 [ 1136.088469] ? do_trap+0xca/0x110 [ 1136.091789] ? do_error_trap+0x65/0x80 [ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.101289] ? exc_invalid_op+0x50/0x70 [ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 [ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.120806] move_linked_works+0x4a/0xa0 [ 1136.124733] worker_thread+0x216/0x3a0 [ 1136.128485] ? __pfx_worker_thread+0x10/0x10 [ 1136.132758] kthread+0xfa/0x240 [ 1136.135904] ? __pfx_kthread+0x10/0x10 [ 1136.139657] ret_from_fork+0x31/0x50 [ 1136.143236] ? __pfx_kthread+0x10/0x10 [ 1136.146988] ret_from_fork_asm+0x1a/0x30 [ 1136.150915] </TASK>

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/3f48cd7f35da07fc0…
https://git.kernel.org/stable/c/a9b1315ed42823961…
https://git.kernel.org/stable/c/9610a2c162ef729a3…
https://git.kernel.org/stable/c/33f64600a12055219…
https://git.kernel.org/stable/c/48ae433c6cc6985f6…
https://git.kernel.org/stable/c/fbd5741a556eaaa63…
https://git.kernel.org/stable/c/0a2c5495b6d1ecb0f…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: f1cd8c40936ff2b560e1f35159dd6a4602b558e5 , < 3f48cd7f35da07fc067cef926bb7f6f4735de37b (git) Affected: 19fce0470f05031e6af36e49ce222d0f0050d432 , < a9b1315ed428239612601e9e188329e7cefa32fd (git) Affected: 19fce0470f05031e6af36e49ce222d0f0050d432 , < 9610a2c162ef729a3988213a4604376e492f6f44 (git) Affected: 19fce0470f05031e6af36e49ce222d0f0050d432 , < 33f64600a12055219bda38b55320c62cdeda9167 (git) Affected: 19fce0470f05031e6af36e49ce222d0f0050d432 , < 48ae433c6cc6985f647b1b37d8bb002972cf9bdb (git) Affected: 19fce0470f05031e6af36e49ce222d0f0050d432 , < fbd5741a556eaaa63d0908132ca79d335b58b1cd (git) Affected: 19fce0470f05031e6af36e49ce222d0f0050d432 , < 0a2c5495b6d1ecb0fa18ef6631450f391a888256 (git) Affected: 5.10.9 , < 5.10.253 (semver)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.118 , ≤ 6.6.* (semver) Unaffected: 6.12.60 , ≤ 6.12.* (semver) Unaffected: 6.17.10 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:12.692Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f48cd7f35da07fc067cef926bb7f6f4735de37b",
              "status": "affected",
              "version": "f1cd8c40936ff2b560e1f35159dd6a4602b558e5",
              "versionType": "git"
            },
            {
              "lessThan": "a9b1315ed428239612601e9e188329e7cefa32fd",
              "status": "affected",
              "version": "19fce0470f05031e6af36e49ce222d0f0050d432",
              "versionType": "git"
            },
            {
              "lessThan": "9610a2c162ef729a3988213a4604376e492f6f44",
              "status": "affected",
              "version": "19fce0470f05031e6af36e49ce222d0f0050d432",
              "versionType": "git"
            },
            {
              "lessThan": "33f64600a12055219bda38b55320c62cdeda9167",
              "status": "affected",
              "version": "19fce0470f05031e6af36e49ce222d0f0050d432",
              "versionType": "git"
            },
            {
              "lessThan": "48ae433c6cc6985f647b1b37d8bb002972cf9bdb",
              "status": "affected",
              "version": "19fce0470f05031e6af36e49ce222d0f0050d432",
              "versionType": "git"
            },
            {
              "lessThan": "fbd5741a556eaaa63d0908132ca79d335b58b1cd",
              "status": "affected",
              "version": "19fce0470f05031e6af36e49ce222d0f0050d432",
              "versionType": "git"
            },
            {
              "lessThan": "0a2c5495b6d1ecb0fa18ef6631450f391a888256",
              "status": "affected",
              "version": "19fce0470f05031e6af36e49ce222d0f0050d432",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.253",
              "status": "affected",
              "version": "5.10.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.10.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl()\n\nnvme_fc_delete_assocation() waits for pending I/O to complete before\nreturning, and an error can cause -\u003eioerr_work to be queued after\ncancel_work_sync() had been called.  Move the call to cancel_work_sync() to\nbe after nvme_fc_delete_association() to ensure -\u003eioerr_work is not running\nwhen the nvme_fc_ctrl object is freed.  Otherwise the following can occur:\n\n[ 1135.911754] list_del corruption, ff2d24c8093f31f8-\u003enext is NULL\n[ 1135.917705] ------------[ cut here ]------------\n[ 1135.922336] kernel BUG at lib/list_debug.c:52!\n[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)\n[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025\n[ 1135.950969] Workqueue:  0x0 (nvme-wq)\n[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff \u003c0f\u003e 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b\n[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046\n[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000\n[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0\n[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08\n[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100\n[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0\n[ 1136.020677] FS:  0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000\n[ 1136.028765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0\n[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 1136.055910] PKRU: 55555554\n[ 1136.058623] Call Trace:\n[ 1136.061074]  \u003cTASK\u003e\n[ 1136.063179]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.067540]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.071898]  ? move_linked_works+0x4a/0xa0\n[ 1136.075998]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.081744]  ? __die_body.cold+0x8/0x12\n[ 1136.085584]  ? die+0x2e/0x50\n[ 1136.088469]  ? do_trap+0xca/0x110\n[ 1136.091789]  ? do_error_trap+0x65/0x80\n[ 1136.095543]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.101289]  ? exc_invalid_op+0x50/0x70\n[ 1136.105127]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.110874]  ? asm_exc_invalid_op+0x1a/0x20\n[ 1136.115059]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.120806]  move_linked_works+0x4a/0xa0\n[ 1136.124733]  worker_thread+0x216/0x3a0\n[ 1136.128485]  ? __pfx_worker_thread+0x10/0x10\n[ 1136.132758]  kthread+0xfa/0x240\n[ 1136.135904]  ? __pfx_kthread+0x10/0x10\n[ 1136.139657]  ret_from_fork+0x31/0x50\n[ 1136.143236]  ? __pfx_kthread+0x10/0x10\n[ 1136.146988]  ret_from_fork_asm+0x1a/0x30\n[ 1136.150915]  \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:05:36.488Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f48cd7f35da07fc067cef926bb7f6f4735de37b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9b1315ed428239612601e9e188329e7cefa32fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9610a2c162ef729a3988213a4604376e492f6f44"
        },
        {
          "url": "https://git.kernel.org/stable/c/33f64600a12055219bda38b55320c62cdeda9167"
        },
        {
          "url": "https://git.kernel.org/stable/c/48ae433c6cc6985f647b1b37d8bb002972cf9bdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbd5741a556eaaa63d0908132ca79d335b58b1cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a2c5495b6d1ecb0fa18ef6631450f391a888256"
        }
      ],
      "title": "nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40261",
    "datePublished": "2025-12-04T16:08:21.345Z",
    "dateReserved": "2025-04-16T07:20:57.182Z",
    "dateUpdated": "2026-06-02T13:00:12.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68206 (GCVE-0-2025-68206)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:48 – Updated: 2026-05-11 21:48

Title

netfilter: nft_ct: add seqadj extension for natted connections

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on the ftp control connection. This can require changes to the TCP length and expected seq / ack_seq. The easiest way to reproduce this issue is with PASV mode. Example ruleset: table inet ftp_nat { ct helper ftp_helper { type "ftp" protocol tcp l3proto inet } chain prerouting { type filter hook prerouting priority 0; policy accept; tcp dport 21 ct state new ct helper set "ftp_helper" } } table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; tcp dport 21 dnat ip prefix to ip daddr map { 192.168.100.1 : 192.168.13.2/32 } } chain postrouting { type nat hook postrouting priority 100 ; policy accept; tcp sport 21 snat ip prefix to ip saddr map { 192.168.13.2 : 192.168.100.1/32 } } } Note that the ftp helper gets assigned *after* the dnat setup. The inverse (nat after helper assign) is handled by an existing check in nf_nat_setup_info() and will not show the problem. Topoloy: +-------------------+ +----------------------------------+ | FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 | +-------------------+ +----------------------------------+ | +-----------------------+ | Client: 192.168.100.2 | +-----------------------+ ftp nat changes do not work as expected in this case: Connected to 192.168.100.1. [..] ftp> epsv EPSV/EPRT on IPv4 off. ftp> ls 227 Entering passive mode (192,168,100,1,209,129). 421 Service not available, remote server has closed connection. Kernel logs: Missing nfct_seqadj_ext_add() setup call WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41 [..] __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat] nf_nat_ftp+0x142/0x280 [nf_nat_ftp] help+0x4d1/0x880 [nf_conntrack_ftp] nf_confirm+0x122/0x2e0 [nf_conntrack] nf_hook_slow+0x3c/0xb0 .. Fix this by adding the required extension when a conntrack helper is assigned to a connection that has a nat binding.

Severity

No CVSS data available.

Assigner

Linux

References

7 references

URL	Tags
https://git.kernel.org/stable/c/83273af0b60c093ba…
https://git.kernel.org/stable/c/b19492c25eff04852…
https://git.kernel.org/stable/c/4de80f0dc3868408d…
https://git.kernel.org/stable/c/b477ef7fa612fa45b…
https://git.kernel.org/stable/c/4ab2cd906e4e1a19d…
https://git.kernel.org/stable/c/2b52d89cbbb0dbe3e…
https://git.kernel.org/stable/c/90918e3b6404c2a37…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < 83273af0b60c093ba0085c205864d8542e1b1653 (git) Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < b19492c25eff04852e0cb58f9bb8238b6695ed2d (git) Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < 4de80f0dc3868408dd7fe9817e507123c9dd8bb0 (git) Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < b477ef7fa612fa45b6b3134d90d1eeb09396500a (git) Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < 4ab2cd906e4e1a19ddbda6eb532851b0e9cda110 (git) Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < 2b52d89cbbb0dbe3e948d8d9a91e704316dccfe6 (git) Affected: 1a64edf54f55d7956cf5a0d95898bc1f84f9b818 , < 90918e3b6404c2a37837b8f11692471b4c512de2 (git)
Linux	Linux	Affected: 4.12 Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.64 , ≤ 6.12.* (semver) Unaffected: 6.17.9 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83273af0b60c093ba0085c205864d8542e1b1653",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            },
            {
              "lessThan": "b19492c25eff04852e0cb58f9bb8238b6695ed2d",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            },
            {
              "lessThan": "4de80f0dc3868408dd7fe9817e507123c9dd8bb0",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            },
            {
              "lessThan": "b477ef7fa612fa45b6b3134d90d1eeb09396500a",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            },
            {
              "lessThan": "4ab2cd906e4e1a19ddbda6eb532851b0e9cda110",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            },
            {
              "lessThan": "2b52d89cbbb0dbe3e948d8d9a91e704316dccfe6",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            },
            {
              "lessThan": "90918e3b6404c2a37837b8f11692471b4c512de2",
              "status": "affected",
              "version": "1a64edf54f55d7956cf5a0d95898bc1f84f9b818",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: add seqadj extension for natted connections\n\nSequence adjustment may be required for FTP traffic with PASV/EPSV modes.\ndue to need to re-write packet payload (IP, port) on the ftp control\nconnection. This can require changes to the TCP length and expected\nseq / ack_seq.\n\nThe easiest way to reproduce this issue is with PASV mode.\nExample ruleset:\ntable inet ftp_nat {\n        ct helper ftp_helper {\n                type \"ftp\" protocol tcp\n                l3proto inet\n        }\n\n        chain prerouting {\n                type filter hook prerouting priority 0; policy accept;\n                tcp dport 21 ct state new ct helper set \"ftp_helper\"\n        }\n}\ntable ip nat {\n        chain prerouting {\n                type nat hook prerouting priority -100; policy accept;\n                tcp dport 21 dnat ip prefix to ip daddr map {\n\t\t\t192.168.100.1 : 192.168.13.2/32 }\n        }\n\n        chain postrouting {\n                type nat hook postrouting priority 100 ; policy accept;\n                tcp sport 21 snat ip prefix to ip saddr map {\n\t\t\t192.168.13.2 : 192.168.100.1/32 }\n        }\n}\n\nNote that the ftp helper gets assigned *after* the dnat setup.\n\nThe inverse (nat after helper assign) is handled by an existing\ncheck in nf_nat_setup_info() and will not show the problem.\n\nTopoloy:\n\n +-------------------+     +----------------------------------+\n | FTP: 192.168.13.2 | \u003c-\u003e | NAT: 192.168.13.3, 192.168.100.1 |\n +-------------------+     +----------------------------------+\n                                      |\n                         +-----------------------+\n                         | Client: 192.168.100.2 |\n                         +-----------------------+\n\nftp nat changes do not work as expected in this case:\nConnected to 192.168.100.1.\n[..]\nftp\u003e epsv\nEPSV/EPRT on IPv4 off.\nftp\u003e ls\n227 Entering passive mode (192,168,100,1,209,129).\n421 Service not available, remote server has closed connection.\n\nKernel logs:\nMissing nfct_seqadj_ext_add() setup call\nWARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41\n[..]\n __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]\n nf_nat_ftp+0x142/0x280 [nf_nat_ftp]\n help+0x4d1/0x880 [nf_conntrack_ftp]\n nf_confirm+0x122/0x2e0 [nf_conntrack]\n nf_hook_slow+0x3c/0xb0\n ..\n\nFix this by adding the required extension when a conntrack helper is assigned\nto a connection that has a nat binding."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:48:46.075Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83273af0b60c093ba0085c205864d8542e1b1653"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19492c25eff04852e0cb58f9bb8238b6695ed2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4de80f0dc3868408dd7fe9817e507123c9dd8bb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b477ef7fa612fa45b6b3134d90d1eeb09396500a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ab2cd906e4e1a19ddbda6eb532851b0e9cda110"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b52d89cbbb0dbe3e948d8d9a91e704316dccfe6"
        },
        {
          "url": "https://git.kernel.org/stable/c/90918e3b6404c2a37837b8f11692471b4c512de2"
        }
      ],
      "title": "netfilter: nft_ct: add seqadj extension for natted connections",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68206",
    "datePublished": "2025-12-16T13:48:33.763Z",
    "dateReserved": "2025-12-16T13:41:40.255Z",
    "dateUpdated": "2026-05-11T21:48:46.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71274 (GCVE-0-2025-71274)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-05-11 21:57

Title

rpmsg: core: fix race in driver_override_show() and use core helper

Summary

In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_show function reads the driver_override string without holding the device_lock. However, the store function modifies and frees the string while holding the device_lock. This creates a race condition where the string can be freed by the store function while being read by the show function, leading to a use-after-free. To fix this, replace the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_store uses the standard driver_set_override helper. Since the introduction of driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to set or clear driver_override, but the implementation was not updated until now. Because driver_set_override modifies and frees the string while holding the device_lock, the new driver_override_show now correctly holds the device_lock during the read operation to prevent the race. Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro simplifies the code.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/392c6b68334aa0e0a…
https://git.kernel.org/stable/c/d66b8074c555e8abb…
https://git.kernel.org/stable/c/47615557447185917…
https://git.kernel.org/stable/c/90c8353f471821d7c…
https://git.kernel.org/stable/c/7654e6e3cd6bdee96…
https://git.kernel.org/stable/c/2e4a70f3c30910427…
https://git.kernel.org/stable/c/954557957177c3c13…
https://git.kernel.org/stable/c/42023d4b6d2661a40…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < d66b8074c555e8abb0ae19eea1c9f3635498bdde (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 47615557447185917afa432b7958f87583c417cb (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 90c8353f471821d7ccd4fe573a2402e056192494 (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 7654e6e3cd6bdee9602f6063b3c670bd556d7e61 (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 2e4a70f3c30910427e5ea848b799066d67b963d5 (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 954557957177c3c13d7c655976665b1170da5e50 (git) Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 42023d4b6d2661a40ee2dcf7e1a3528a35c638ca (git)
Linux	Linux	Affected: 4.18 Unaffected: 0 , < 4.18 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "d66b8074c555e8abb0ae19eea1c9f3635498bdde",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "47615557447185917afa432b7958f87583c417cb",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "90c8353f471821d7ccd4fe573a2402e056192494",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "7654e6e3cd6bdee9602f6063b3c670bd556d7e61",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "2e4a70f3c30910427e5ea848b799066d67b963d5",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "954557957177c3c13d7c655976665b1170da5e50",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "42023d4b6d2661a40ee2dcf7e1a3528a35c638ca",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: core: fix race in driver_override_show() and use core helper\n\nThe driver_override_show function reads the driver_override string\nwithout holding the device_lock. However, the store function modifies\nand frees the string while holding the device_lock. This creates a race\ncondition where the string can be freed by the store function while\nbeing read by the show function, leading to a use-after-free.\n\nTo fix this, replace the rpmsg_string_attr macro with explicit show and\nstore functions. The new driver_override_store uses the standard\ndriver_set_override helper. Since the introduction of\ndriver_set_override, the comments in include/linux/rpmsg.h have stated\nthat this helper must be used to set or clear driver_override, but the\nimplementation was not updated until now.\n\nBecause driver_set_override modifies and frees the string while holding\nthe device_lock, the new driver_override_show now correctly holds the\ndevice_lock during the read operation to prevent the race.\n\nAdditionally, since rpmsg_string_attr has only ever been used for\ndriver_override, removing the macro simplifies the code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:57:13.516Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d66b8074c555e8abb0ae19eea1c9f3635498bdde"
        },
        {
          "url": "https://git.kernel.org/stable/c/47615557447185917afa432b7958f87583c417cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c8353f471821d7ccd4fe573a2402e056192494"
        },
        {
          "url": "https://git.kernel.org/stable/c/7654e6e3cd6bdee9602f6063b3c670bd556d7e61"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e4a70f3c30910427e5ea848b799066d67b963d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/954557957177c3c13d7c655976665b1170da5e50"
        },
        {
          "url": "https://git.kernel.org/stable/c/42023d4b6d2661a40ee2dcf7e1a3528a35c638ca"
        }
      ],
      "title": "rpmsg: core: fix race in driver_override_show() and use core helper",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71274",
    "datePublished": "2026-05-06T11:27:07.525Z",
    "dateReserved": "2026-03-17T09:08:18.458Z",
    "dateUpdated": "2026-05-11T21:57:13.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71292 (GCVE-0-2025-71292)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:32 – Updated: 2026-05-11 21:57

Title

jfs: nlink overflow in jfs_rename

Summary

In the Linux kernel, the following vulnerability has been resolved: jfs: nlink overflow in jfs_rename If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink of the first directory is first incremented and later decremented. Normally this is fine, but when nlink = -1 this causes a wrap around to 0, and then drop_nlink issues a warning. After applying the patch syzbot no longer issues any warnings. I also ran some basic fs tests to look for any regressions.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/2108829a59f081e82…
https://git.kernel.org/stable/c/b4330a0d0947fbdc9…
https://git.kernel.org/stable/c/a3d66089e50a6e014…
https://git.kernel.org/stable/c/f70fcbc2ac7c24f08…
https://git.kernel.org/stable/c/5d77c36cd4b698649…
https://git.kernel.org/stable/c/fe136426e30ca6deb…
https://git.kernel.org/stable/c/93c325746ae59709b…
https://git.kernel.org/stable/c/9218dc26fd922b098…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2108829a59f081e822fdab8c2cd7131deb8aa8a1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a3d66089e50a6e0142f8884471f74292102ea9aa (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f70fcbc2ac7c24f087a2c895c5753aa730b1e479 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5d77c36cd4b698649f5c30c5f6c084f4f61d1880 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fe136426e30ca6debcf916fd6a141555ed9fde74 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 93c325746ae59709b4f9bad4e3e4761c8d566c70 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9218dc26fd922b09858ecd3666ed57dfd8098da8 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jfs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2108829a59f081e822fdab8c2cd7131deb8aa8a1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a3d66089e50a6e0142f8884471f74292102ea9aa",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f70fcbc2ac7c24f087a2c895c5753aa730b1e479",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5d77c36cd4b698649f5c30c5f6c084f4f61d1880",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fe136426e30ca6debcf916fd6a141555ed9fde74",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "93c325746ae59709b4f9bad4e3e4761c8d566c70",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9218dc26fd922b09858ecd3666ed57dfd8098da8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jfs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: nlink overflow in jfs_rename\n\nIf nlink is maximal for a directory (-1) and inside that directory you\nperform a rename for some child directory (not moving from the parent),\nthen the nlink of the first directory is first incremented and later\ndecremented. Normally this is fine, but when nlink = -1 this causes a\nwrap around to 0, and then drop_nlink issues a warning.\n\nAfter applying the patch syzbot no longer issues any warnings. I also\nran some basic fs tests to look for any regressions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:57:22.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2108829a59f081e822fdab8c2cd7131deb8aa8a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3d66089e50a6e0142f8884471f74292102ea9aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/f70fcbc2ac7c24f087a2c895c5753aa730b1e479"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d77c36cd4b698649f5c30c5f6c084f4f61d1880"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe136426e30ca6debcf916fd6a141555ed9fde74"
        },
        {
          "url": "https://git.kernel.org/stable/c/93c325746ae59709b4f9bad4e3e4761c8d566c70"
        },
        {
          "url": "https://git.kernel.org/stable/c/9218dc26fd922b09858ecd3666ed57dfd8098da8"
        }
      ],
      "title": "jfs: nlink overflow in jfs_rename",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71292",
    "datePublished": "2026-05-06T11:32:23.897Z",
    "dateReserved": "2026-05-06T11:31:45.509Z",
    "dateUpdated": "2026-05-11T21:57:22.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71304 (GCVE-0-2025-71304)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:14 – Updated: 2026-05-27 12:14

Title

smack: /smack/doi: accept previously used values

Summary

In the Linux kernel, the following vulnerability has been resolved: smack: /smack/doi: accept previously used values Writing to /smack/doi a value that has ever been written there in the past disables networking for non-ambient labels. E.g. # cat /smack/doi 3 # netlabelctl -p cipso list Configured CIPSO mappings (1) DOI value : 3 mapping type : PASS_THROUGH # netlabelctl -p map list Configured NetLabel domain mappings (3) domain: "_" (IPv4) protocol: UNLABELED domain: DEFAULT (IPv4) protocol: CIPSO, DOI = 3 domain: DEFAULT (IPv6) protocol: UNLABELED # cat /smack/ambient _ # cat /proc/$$/attr/smack/current _ # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.964 ms # echo foo >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.956 ms unknown option 86 # echo 4 >/smack/doi # echo 3 >/smack/doi !> [ 214.050395] smk_cipso_doi:691 cipso add rc = -17 # echo 3 >/smack/doi !> [ 249.402261] smk_cipso_doi:678 remove rc = -2 !> [ 249.402261] smk_cipso_doi:691 cipso add rc = -17 # ping -c1 10.1.95.12 !!> ping: 10.1.95.12: Address family for hostname not supported # echo _ >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.617 ms This happens because Smack keeps decommissioned DOIs, fails to re-add them, and consequently refuses to add the “default” domain map: # netlabelctl -p cipso list Configured CIPSO mappings (2) DOI value : 3 mapping type : PASS_THROUGH DOI value : 4 mapping type : PASS_THROUGH # netlabelctl -p map list Configured NetLabel domain mappings (2) domain: "_" (IPv4) protocol: UNLABELED !> (no ipv4 map for default domain here) domain: DEFAULT (IPv6) protocol: UNLABELED Fix by clearing decommissioned DOI definitions and serializing concurrent DOI updates with a new lock. Also: - allow /smack/doi to live unconfigured, since adding a map (netlbl_cfg_cipsov4_map_add) may fail. CIPSO_V4_DOI_UNKNOWN(0) indicates the unconfigured DOI - add new DOI before removing the old default map, so the old map remains if the add fails (2008-02-04, Casey Schaufler)

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/eb718a3c8181ada67…
https://git.kernel.org/stable/c/6ec091c5c7eeabd24…
https://git.kernel.org/stable/c/199452f22d2f74b89…
https://git.kernel.org/stable/c/1c7ee23dfcd18d807…
https://git.kernel.org/stable/c/f8071500177f38cff…
https://git.kernel.org/stable/c/5a247a84de0ba44ed…
https://git.kernel.org/stable/c/8beebb8ad9a003f97…
https://git.kernel.org/stable/c/33d589ed60ae433b4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < eb718a3c8181ada679340db34cd61bce48e44749 (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < 6ec091c5c7eeabd249a7c46813cad1e9f555f859 (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < 199452f22d2f74b897fe826f81ec402b0a8461a0 (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < 1c7ee23dfcd18d80770d8f90f2ab5bb1b2bfd8a3 (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < f8071500177f38cff38892bd85ac631cc6e010b2 (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < 5a247a84de0ba44edbbd6be851c8a6b2aa60ff85 (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < 8beebb8ad9a003f978e53b06237986588223e15e (git) Affected: e114e473771c848c3cfec05f0123e70f1cdbdc99 , < 33d589ed60ae433b483761987b85e0d24e54584e (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/smack/smackfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb718a3c8181ada679340db34cd61bce48e44749",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "6ec091c5c7eeabd249a7c46813cad1e9f555f859",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "199452f22d2f74b897fe826f81ec402b0a8461a0",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "1c7ee23dfcd18d80770d8f90f2ab5bb1b2bfd8a3",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "f8071500177f38cff38892bd85ac631cc6e010b2",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "5a247a84de0ba44edbbd6be851c8a6b2aa60ff85",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "8beebb8ad9a003f978e53b06237986588223e15e",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            },
            {
              "lessThan": "33d589ed60ae433b483761987b85e0d24e54584e",
              "status": "affected",
              "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/smack/smackfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: /smack/doi: accept previously used values\n\nWriting to /smack/doi a value that has ever been\nwritten there in the past disables networking for\nnon-ambient labels.\nE.g.\n\n    # cat /smack/doi\n    3\n    # netlabelctl -p cipso list\n    Configured CIPSO mappings (1)\n     DOI value : 3\n       mapping type : PASS_THROUGH\n    # netlabelctl -p map list\n    Configured NetLabel domain mappings (3)\n     domain: \"_\" (IPv4)\n       protocol: UNLABELED\n     domain: DEFAULT (IPv4)\n       protocol: CIPSO, DOI = 3\n     domain: DEFAULT (IPv6)\n       protocol: UNLABELED\n\n    # cat /smack/ambient\n    _\n    # cat /proc/$$/attr/smack/current\n    _\n    # ping -c1 10.1.95.12\n    64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.964 ms\n    # echo foo \u003e/proc/$$/attr/smack/current\n    # ping -c1 10.1.95.12\n    64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.956 ms\n    unknown option 86\n\n    # echo 4 \u003e/smack/doi\n    # echo 3 \u003e/smack/doi\n!\u003e  [  214.050395] smk_cipso_doi:691 cipso add rc = -17\n    # echo 3 \u003e/smack/doi\n!\u003e  [  249.402261] smk_cipso_doi:678 remove rc = -2\n!\u003e  [  249.402261] smk_cipso_doi:691 cipso add rc = -17\n\n    # ping -c1 10.1.95.12\n!!\u003e ping: 10.1.95.12: Address family for hostname not supported\n\n    # echo _ \u003e/proc/$$/attr/smack/current\n    # ping -c1 10.1.95.12\n    64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.617 ms\n\nThis happens because Smack keeps decommissioned DOIs,\nfails to re-add them, and consequently refuses to add\nthe \u201cdefault\u201d domain map:\n\n    # netlabelctl -p cipso list\n    Configured CIPSO mappings (2)\n     DOI value : 3\n       mapping type : PASS_THROUGH\n     DOI value : 4\n       mapping type : PASS_THROUGH\n    # netlabelctl -p map list\n    Configured NetLabel domain mappings (2)\n     domain: \"_\" (IPv4)\n       protocol: UNLABELED\n!\u003e  (no ipv4 map for default domain here)\n     domain: DEFAULT (IPv6)\n       protocol: UNLABELED\n\nFix by clearing decommissioned DOI definitions and\nserializing concurrent DOI updates with a new lock.\n\nAlso:\n- allow /smack/doi to live unconfigured, since\n  adding a map (netlbl_cfg_cipsov4_map_add) may fail.\n  CIPSO_V4_DOI_UNKNOWN(0) indicates the unconfigured DOI\n- add new DOI before removing the old default map,\n  so the old map remains if the add fails\n\n(2008-02-04, Casey Schaufler)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:14:53.289Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb718a3c8181ada679340db34cd61bce48e44749"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ec091c5c7eeabd249a7c46813cad1e9f555f859"
        },
        {
          "url": "https://git.kernel.org/stable/c/199452f22d2f74b897fe826f81ec402b0a8461a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c7ee23dfcd18d80770d8f90f2ab5bb1b2bfd8a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8071500177f38cff38892bd85ac631cc6e010b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a247a84de0ba44edbbd6be851c8a6b2aa60ff85"
        },
        {
          "url": "https://git.kernel.org/stable/c/8beebb8ad9a003f978e53b06237986588223e15e"
        },
        {
          "url": "https://git.kernel.org/stable/c/33d589ed60ae433b483761987b85e0d24e54584e"
        }
      ],
      "title": "smack: /smack/doi: accept previously used values",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71304",
    "datePublished": "2026-05-27T12:14:53.289Z",
    "dateReserved": "2026-05-08T13:14:33.087Z",
    "dateUpdated": "2026-05-27T12:14:53.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23100 (GCVE-0-2026-23100)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-05-23 16:03

Title

mm/hugetlb: fix hugetlb_pmd_shared()

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb_pmd_shared() Patch series "mm/hugetlb: fixes for PMD table sharing (incl. using mmu_gather)", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I recently shared [1] for the performance fix, deferring most of the cleanups I had in the prototype to a later point. While doing that I identified the other things. The goal of this patch set is to be backported to stable trees "fairly" easily. At least patch #1 and #4. Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing Patch #2 + #3 are simple comment fixes that patch #4 interacts with. Patch #4 is a fix for the reported performance regression due to excessive IPI broadcasts during fork()+exit(). The last patch is all about TLB flushes, IPIs and mmu_gather. Read: complicated There are plenty of cleanups in the future to be had + one reasonable optimization on x86. But that's all out of scope for this series. Runtime tested, with a focus on fixing the performance regression using the original reproducer [2] on x86. This patch (of 4): We switched from (wrongly) using the page count to an independent shared count. Now, shared page tables have a refcount of 1 (excluding speculative references) and instead use ptdesc->pt_share_count to identify sharing. We didn't convert hugetlb_pmd_shared(), so right now, we would never detect a shared PMD table as such, because sharing/unsharing no longer touches the refcount of a PMD table. Page migration, like mbind() or migrate_pages() would allow for migrating folios mapped into such shared PMD tables, even though the folios are not exclusive. In smaps we would account them as "private" although they are "shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the pagemap interface. Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().

Severity

No CVSS data available.

Assigner

Linux

References

7 references

URL	Tags
https://git.kernel.org/stable/c/8ae48255bcb17b324…
https://git.kernel.org/stable/c/bf3c2affe245cf831…
https://git.kernel.org/stable/c/5b2aec77f92265a90…
https://git.kernel.org/stable/c/51dcf459845fd28f5…
https://git.kernel.org/stable/c/3a18b452dd5f7f165…
https://git.kernel.org/stable/c/69c4e241ff13545d4…
https://git.kernel.org/stable/c/ca1a47cd3f5f4c46c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133 , < 8ae48255bcb17b32436be97553dca848730d365f (git) Affected: 8410996eb6fea116fe1483ed977aacf580eee7b4 , < bf3c2affe245cf831866ddc8f736ae6a22cdc11c (git) Affected: 02333ac1c35370517a19a4a131332a9690c6a5c7 , < 5b2aec77f92265a9028c5f632bdd9af5b57ec3a3 (git) Affected: 56b274473d6e7e7375f2d0a2b4aca11d67c6b52f , < 51dcf459845fd28f5a0d83d408a379b274ec5cc5 (git) Affected: 2e31443a0d18ae43b9d29e02bf0563f07772193d , < 3a18b452dd5f7f1652c2e92f8ae769aa17a66c9e (git) Affected: 59d9094df3d79443937add8700b2ef1a866b1081 , < 69c4e241ff13545d410a8b2a688c932182a858bf (git) Affected: 59d9094df3d79443937add8700b2ef1a866b1081 , < ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216 (git) Affected: 5.10.239 , < 5.10.253 (semver) Affected: 5.15.186 , < 5.15.203 (semver) Affected: 6.1.142 , < 6.1.167 (semver) Affected: 6.6.72 , < 6.6.127 (semver) Affected: 6.12.9 , < 6.12.74 (semver)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.127 , ≤ 6.6.* (semver) Unaffected: 6.12.74 , ≤ 6.12.* (semver) Unaffected: 6.18.8 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/hugetlb.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ae48255bcb17b32436be97553dca848730d365f",
              "status": "affected",
              "version": "94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133",
              "versionType": "git"
            },
            {
              "lessThan": "bf3c2affe245cf831866ddc8f736ae6a22cdc11c",
              "status": "affected",
              "version": "8410996eb6fea116fe1483ed977aacf580eee7b4",
              "versionType": "git"
            },
            {
              "lessThan": "5b2aec77f92265a9028c5f632bdd9af5b57ec3a3",
              "status": "affected",
              "version": "02333ac1c35370517a19a4a131332a9690c6a5c7",
              "versionType": "git"
            },
            {
              "lessThan": "51dcf459845fd28f5a0d83d408a379b274ec5cc5",
              "status": "affected",
              "version": "56b274473d6e7e7375f2d0a2b4aca11d67c6b52f",
              "versionType": "git"
            },
            {
              "lessThan": "3a18b452dd5f7f1652c2e92f8ae769aa17a66c9e",
              "status": "affected",
              "version": "2e31443a0d18ae43b9d29e02bf0563f07772193d",
              "versionType": "git"
            },
            {
              "lessThan": "69c4e241ff13545d410a8b2a688c932182a858bf",
              "status": "affected",
              "version": "59d9094df3d79443937add8700b2ef1a866b1081",
              "versionType": "git"
            },
            {
              "lessThan": "ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216",
              "status": "affected",
              "version": "59d9094df3d79443937add8700b2ef1a866b1081",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.253",
              "status": "affected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.127",
              "status": "affected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.74",
              "status": "affected",
              "version": "6.12.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/hugetlb.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.10.239",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "6.6.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "6.12.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb_pmd_shared()\n\nPatch series \"mm/hugetlb: fixes for PMD table sharing (incl.  using\nmmu_gather)\", v3.\n\nOne functional fix, one performance regression fix, and two related\ncomment fixes.\n\nI cleaned up my prototype I recently shared [1] for the performance fix,\ndeferring most of the cleanups I had in the prototype to a later point. \nWhile doing that I identified the other things.\n\nThe goal of this patch set is to be backported to stable trees \"fairly\"\neasily. At least patch #1 and #4.\n\nPatch #1 fixes hugetlb_pmd_shared() not detecting any sharing\nPatch #2 + #3 are simple comment fixes that patch #4 interacts with.\nPatch #4 is a fix for the reported performance regression due to excessive\nIPI broadcasts during fork()+exit().\n\nThe last patch is all about TLB flushes, IPIs and mmu_gather.\nRead: complicated\n\nThere are plenty of cleanups in the future to be had + one reasonable\noptimization on x86. But that\u0027s all out of scope for this series.\n\nRuntime tested, with a focus on fixing the performance regression using\nthe original reproducer [2] on x86.\n\n\nThis patch (of 4):\n\nWe switched from (wrongly) using the page count to an independent shared\ncount.  Now, shared page tables have a refcount of 1 (excluding\nspeculative references) and instead use ptdesc-\u003ept_share_count to identify\nsharing.\n\nWe didn\u0027t convert hugetlb_pmd_shared(), so right now, we would never\ndetect a shared PMD table as such, because sharing/unsharing no longer\ntouches the refcount of a PMD table.\n\nPage migration, like mbind() or migrate_pages() would allow for migrating\nfolios mapped into such shared PMD tables, even though the folios are not\nexclusive.  In smaps we would account them as \"private\" although they are\n\"shared\", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the\npagemap interface.\n\nFix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:03:51.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ae48255bcb17b32436be97553dca848730d365f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf3c2affe245cf831866ddc8f736ae6a22cdc11c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b2aec77f92265a9028c5f632bdd9af5b57ec3a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/51dcf459845fd28f5a0d83d408a379b274ec5cc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a18b452dd5f7f1652c2e92f8ae769aa17a66c9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/69c4e241ff13545d410a8b2a688c932182a858bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216"
        }
      ],
      "title": "mm/hugetlb: fix hugetlb_pmd_shared()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23100",
    "datePublished": "2026-02-04T16:08:22.592Z",
    "dateReserved": "2026-01-13T15:37:45.965Z",
    "dateUpdated": "2026-05-23T16:03:51.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0696

Solutions

CVE-2024-56584 (GCVE-0-2024-56584)

CVE-2025-39748 (GCVE-0-2025-39748)

CVE-2025-39764 (GCVE-0-2025-39764)

CVE-2025-40219 (GCVE-0-2025-40219)

CVE-2025-40261 (GCVE-0-2025-40261)

CVE-2025-68206 (GCVE-0-2025-68206)

CVE-2025-71274 (GCVE-0-2025-71274)

CVE-2025-71292 (GCVE-0-2025-71292)

CVE-2025-71304 (GCVE-0-2025-71304)

CVE-2026-23100 (GCVE-0-2026-23100)

Tags

Sightings

Nomenclature