Vulnerability-Lookup

RHSA-2026:99135

Vulnerability from csaf_redhat - Published: 2026-11-12 03:05 - Updated: 2026-11-12 17:25

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Moderate

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162) * kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452) * kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451) * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222) * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221) * kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553) * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571) * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) * kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956) * kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207) * kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116) * kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) * kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442) * kernel: ALSA: ua101: reject mismatched capture/playback packet sizes (CVE-2026-98741) * kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032) * kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152) * kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153) Bug Fix(es) and Enhancement(s): * [RHEL9.9z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255218) * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e) [rhel-9.9.z] (JIRA:RHEL-256280) * MADVISE i/o size in RHEL 9 additionally limited by read_ahead_kb - Was addressed in RHEL8 via RHEL-22476 [rhel-9.9.z] (JIRA:RHEL-259532) * try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.9.z] (JIRA:RHEL-269061) * RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.9.z] (JIRA:RHEL-270893) * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.9.z] (JIRA:RHEL-274411) * af_unix: Fix peek then tail dereference UAF in unix_stream_data_wait() [rhel-9.9] (JIRA:RHEL-275410) * Kernel panic after stopping retis capture [rhel-9.9.z] (JIRA:RHEL-275457) * Hard lockup experienced with repro from RHEL-282072 [rhel-9.9.z] (JIRA:RHEL-290031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-53196

A flaw was found in the Linux kernel's `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device's I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service).

6.8 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products

Product	Version	Remediation
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debug-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debug-devel-matched-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-64k-devel-matched-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debug-devel-matched-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-ppc64le-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-s390x-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-devel-matched-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-doc-0:5.14.0-741.22.1.el9_9.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-zfcpdump-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-zfcpdump-devel-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:kernel-zfcpdump-devel-matched-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.22.1.el9_9.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debug-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-64k-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-abi-stablelists-0:5.14.0-741.22.1.el9_9.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-modules-extra-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debug-uki-virt-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-ppc64le-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-s390x-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-modules-extra-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-libs-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-libs-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-tools-libs-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-uki-virt-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-uki-virt-addons-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-core-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-modules-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-modules-core-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:kernel-zfcpdump-modules-extra-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-ppc64le-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-s390x-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-libs-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-libs-devel-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-tools-libs-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:kernel-zfcpdump-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-common-aarch64-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-debuginfo-common-x86_64-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debug-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-64k-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debug-modules-extra-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-devel-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-core-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-rt-modules-extra-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:kernel-tools-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:libperf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:python3-perf-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:rtla-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.9.0.Z.MAIN:rv-debuginfo-0:5.14.0-741.22.1.el9_9.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-68140

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the `net/iucv` component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to memory corruption, potentially resulting in a system crash (denial of service) or allowing an attacker to execute arbitrary code.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-68162

A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. This Use-After-Free (UAF) vulnerability occurs during network namespace (netns) teardown. A local attacker with the ability to open a sysctl file could exploit this flaw, potentially leading to a system crash or other undefined behavior due to memory corruption.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-68451

A flaw was found in the Linux kernel's s390 zcrypt module. The `cca_ecc2protkey()` function, responsible for handling Common Cryptographic Architecture (CCA) Elliptic Curve Cryptography (ECC) private key requests, does not properly validate the length of the key token. This allows a local attacker to provide a malformed key token, potentially leading to memory corruption and a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-68452

A flaw was found in the Linux kernel's s390/zcrypt component. This vulnerability arises from insufficient validation of the length of CCA AES cipher key requests. A local attacker could exploit this by providing a specially crafted key token, which may lead to a buffer overflow. This could result in a denial of service, making the system unavailable.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-72221

A flaw was found in the kernel. A race condition exists in the sunrpc component during the Transport Layer Security (TLS) handshake cancellation process. This can lead to the corruption of an internal data structure, potentially causing system instability or a denial of service. Additionally, it may cause connections to be prematurely terminated, further contributing to a denial of service.

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-366 - Race Condition within a Thread

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-72222

A flaw was found in the Linux kernel's sunrpc component, which affects TLS-enabled Network File System (NFS) servers. A race condition exists during the asynchronous TLS handshake process. A remote attacker could exploit this by closing a connection at a specific time, leading to memory corruption. This could result in system instability or other unpredictable behavior.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-74385

A flaw was found in the `nvmet-tcp` component of the Linux kernel. This vulnerability arises from ignoring the return value of a function during the TLS handshake, specifically when the network socket is not in an established state. This oversight prevents proper cleanup, leading to the leakage of queues and sockets. An attacker could potentially exploit this issue to cause resource exhaustion, resulting in a Denial of Service (DoS).

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-772 - Missing Release of Resource after Effective Lifetime

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-74586

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resulting in a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-74588

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This use-after-free vulnerability occurs when the system improperly handles chunk transport pointers during the retransmission process. A remote attacker can exploit this by sending specially crafted Selective Acknowledgment (SACK) packets, which can lead to a dangling pointer dereference. The most significant consequence is a system crash, resulting in a denial of service (DoS). In some scenarios, this could potentially lead to arbitrary code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-74752

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP). When cookie authentication is disabled, the system improperly validates authentication (AUTH) fields restored directly from peer-controlled cookie bytes. A local attacker could exploit this by forging `RANDOM` lengths or `HMAC` identifiers within these cookies. This could lead to out-of-bounds reads and, more critically, a 32-byte write past a zero-length AUTH chunk, providing a primitive for local privilege escalation.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-80553

A flaw was found in the `s390/vfio_ccw` component of the Linux kernel. This vulnerability arises from the improper management of workqueues, where existing tasks might not be canceled before associated resources are released. A local attacker could potentially leverage this issue to trigger a use-after-free condition, which may result in system instability or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-80571

A flaw was found in the Linux kernel's `powerpc/pseries: papr-phy-attest` component. This vulnerability arises from insufficient validation of a command length parameter, which can lead to a buffer overflow. Such an overflow could be exploited by a local attacker to potentially execute arbitrary code or cause a system crash (denial of service). Additionally, improper memory deallocation in error handling paths could result in a memory leak, further contributing to system instability.

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-80584

A flaw was found in the Linux kernel's s390/qeth component. This vulnerability allows a local attacker to trigger an integer underflow when handling user-supplied buffer lengths in the `qeth_snmp_command()` and `qeth_l3_arp_query()` functions. This can lead to an out-of-bounds write, potentially causing memory corruption and system instability or a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-80586

A flaw was found in the Linux kernel's Multipath TCP (mptcp) implementation. A remote attacker could send specially crafted Data Sink Selection (DSS) options with an unexpected size. This could lead to data inconsistency or the access of uninitialized data, potentially resulting in information disclosure or a denial of service.

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-824 - Access of Uninitialized Pointer

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-80792

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-80981

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the `smc_llc_srv_add_link()` function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-89479

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the kernel attempts to access memory that has already been deallocated, which could result in a denial of service.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-89633

A flaw was found in the Linux kernel's Server Message Block (SMB) client. The `coalesce_t2()` function processes server-supplied `DataOffset` fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-bounds read and write operations, potentially resulting in information disclosure or arbitrary code execution.

8.0 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-89956

A flaw was found in the Linux kernel's s390/vfio-ap component. Two functions, vfio_ap_mdev_probe and vfio_ap_mdev_for_queue, access a list of ap_matrix_mdev objects without holding the required mutex. This concurrency issue could allow an attacker to cause kernel memory corruption or a use-after-free condition, potentially leading to system instability or denial of service.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-90207

A flaw was found in the Advanced Linux Sound Architecture (ALSA) MIDI sequencer component of the Linux kernel. A race condition can occur during the teardown of a rawmidi substream while input events are being processed. This can lead to a null pointer dereference, allowing a local attacker to cause a denial of service by crashing the kernel.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-98116

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) sound subsystem. A race condition between concurrent memory mapping operations and audio buffer reallocations allows memory pages to be released while still mapped as writable. A local user can exploit this vulnerability to trigger a use-after-free condition, potentially resulting in local privilege escalation or a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-98318

A flaw was found in the Linux kernel's SMB (Server Message Block) client. When handling absolute symbolic links on mounted shares, the client fails to validate the link target format before applying Windows NT path adjustments. A user with write access to a mounted share can exploit this vulnerability by creating a specially crafted symbolic link, triggering out-of-bounds memory writes and a buffer overflow. This flaw can result in a Denial of Service (DoS) by crashing the system or potentially allow arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-98442

A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption through a use-after-free vulnerability. This issue occurs because connection tracking helpers record pointers to extension memory before all extensions are added, leaving invalid references when memory is subsequently reallocated.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-98741

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initialization. An attacker who connects a specially crafted USB device can trigger an out-of-bounds memory write past the playback buffer. This vulnerability can lead to a denial of service (DoS) through a kernel crash or potentially allow arbitrary code execution with kernel privileges.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-99032

A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. A race condition in the smc_getname() function allows an underlying socket to be released while its address information is being retrieved. A local user can exploit this vulnerability to trigger a use-after-free condition, resulting in a Denial of Service (DoS) through a kernel crash or potentially allowing privilege escalation.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Moderate

CVE-2026-99152

A flaw was found in the Linux kernel's SCSI iSCSI implementation (libiscsi). A remote, connected iSCSI target can cause a Denial of Service (DoS) by sending a crafted management response that references an uninitialized or free task slot. Because the kernel fails to verify that the task is active before attempting to process its connection details, this action leads to a null-pointer dereference and crashes the operating system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-99153

A flaw was found in the Linux kernel's SCSI subsystem within the libiscsi module. A malicious or compromised iSCSI storage target can trigger a denial of service (DoS) or data integrity issues by sending a crafted Reject Protocol Data Unit (PDU) containing an unvalidated Initiator Task Tag (ITT). Because the kernel fails to verify that the reflected task identifier corresponds to a valid in-flight request, it may attempt to process an uninitialized or freed task. This improper handling leads to a null-pointer dereference and a kernel crash, or causes read operations to complete without receiving actual data.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

CVE-2026-99999

A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.

8.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 360 products, the same list as for CVE-2026-53196

Threats

Impact Important

References

189 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:99135	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513293	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513314	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515351	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515353	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516278	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516412	external
https://bugzilla.redhat.com/show_bug.cgi?id=2516837	external
https://bugzilla.redhat.com/show_bug.cgi?id=2521384	external
https://bugzilla.redhat.com/show_bug.cgi?id=2521419	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524422	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524438	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524442	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524458	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524475	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528542	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532104	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532230	external
https://bugzilla.redhat.com/show_bug.cgi?id=2532290	external
https://bugzilla.redhat.com/show_bug.cgi?id=2535200	external
https://bugzilla.redhat.com/show_bug.cgi?id=2536701	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541360	external
https://bugzilla.redhat.com/show_bug.cgi?id=2546374	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2554848	external
https://bugzilla.redhat.com/show_bug.cgi?id=2555081	external
https://bugzilla.redhat.com/show_bug.cgi?id=2559710	external
https://bugzilla.redhat.com/show_bug.cgi?id=2562697	external
https://bugzilla.redhat.com/show_bug.cgi?id=2562706	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-53196	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	external
https://www.cve.org/CVERecord?id=CVE-2026-53196	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53196	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-68140	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513293	external
https://www.cve.org/CVERecord?id=CVE-2026-68140	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68140	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68162	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513314	external
https://www.cve.org/CVERecord?id=CVE-2026-68162	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68162	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68451	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515353	external
https://www.cve.org/CVERecord?id=CVE-2026-68451	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68451	external
https://kernelcve.org/list/?q=CVE-2026-68451	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68452	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515351	external
https://www.cve.org/CVERecord?id=CVE-2026-68452	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68452	external
https://kernelcve.org/list/?q=CVE-2026-68452	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72221	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516412	external
https://www.cve.org/CVERecord?id=CVE-2026-72221	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72221	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-72222	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516278	external
https://www.cve.org/CVERecord?id=CVE-2026-72222	external
https://nvd.nist.gov/vuln/detail/CVE-2026-72222	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-74385	self
https://bugzilla.redhat.com/show_bug.cgi?id=2516837	external
https://www.cve.org/CVERecord?id=CVE-2026-74385	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74385	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-74586	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521419	external
https://www.cve.org/CVERecord?id=CVE-2026-74586	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74586	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-74588	self
https://bugzilla.redhat.com/show_bug.cgi?id=2521384	external
https://www.cve.org/CVERecord?id=CVE-2026-74588	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74588	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-74752	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524422	external
https://www.cve.org/CVERecord?id=CVE-2026-74752	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74752	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80553	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524442	external
https://www.cve.org/CVERecord?id=CVE-2026-80553	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80553	external
https://kernelcve.org/list/?q=CVE-2026-80553	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80571	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524458	external
https://www.cve.org/CVERecord?id=CVE-2026-80571	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80571	external
https://kernelcve.org/list/?q=CVE-2026-80571	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80584	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524475	external
https://www.cve.org/CVERecord?id=CVE-2026-80584	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80584	external
https://kernelcve.org/list/?q=CVE-2026-80584	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80586	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524438	external
https://www.cve.org/CVERecord?id=CVE-2026-80586	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80586	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80792	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528542	external
https://www.cve.org/CVERecord?id=CVE-2026-80792	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80792	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-80981	self
https://bugzilla.redhat.com/show_bug.cgi?id=2532104	external
https://www.cve.org/CVERecord?id=CVE-2026-80981	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80981	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://kernelcve.org/list/?q=CVE-2026-80981	external
https://access.redhat.com/security/cve/CVE-2026-89479	self
https://bugzilla.redhat.com/show_bug.cgi?id=2532290	external
https://www.cve.org/CVERecord?id=CVE-2026-89479	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89479	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-89633	self
https://bugzilla.redhat.com/show_bug.cgi?id=2532230	external
https://www.cve.org/CVERecord?id=CVE-2026-89633	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89633	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-89956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2535200	external
https://www.cve.org/CVERecord?id=CVE-2026-89956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89956	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://kernelcve.org/list/?q=CVE-2026-89956	external
https://access.redhat.com/security/cve/CVE-2026-90207	self
https://bugzilla.redhat.com/show_bug.cgi?id=2536701	external
https://www.cve.org/CVERecord?id=CVE-2026-90207	external
https://nvd.nist.gov/vuln/detail/CVE-2026-90207	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98116	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541360	external
https://www.cve.org/CVERecord?id=CVE-2026-98116	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98116	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98318	self
https://bugzilla.redhat.com/show_bug.cgi?id=2546374	external
https://www.cve.org/CVERecord?id=CVE-2026-98318	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98318	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98442	self
https://bugzilla.redhat.com/show_bug.cgi?id=2554848	external
https://www.cve.org/CVERecord?id=CVE-2026-98442	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98442	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-98741	self
https://bugzilla.redhat.com/show_bug.cgi?id=2555081	external
https://www.cve.org/CVERecord?id=CVE-2026-98741	external
https://nvd.nist.gov/vuln/detail/CVE-2026-98741	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-99032	self
https://bugzilla.redhat.com/show_bug.cgi?id=2559710	external
https://www.cve.org/CVERecord?id=CVE-2026-99032	external
https://nvd.nist.gov/vuln/detail/CVE-2026-99032	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://kernelcve.org/list/?q=CVE-2026-99032	external
https://access.redhat.com/security/cve/CVE-2026-99152	self
https://bugzilla.redhat.com/show_bug.cgi?id=2562697	external
https://www.cve.org/CVERecord?id=CVE-2026-99152	external
https://nvd.nist.gov/vuln/detail/CVE-2026-99152	external
https://git.kernel.org/stable/c/11bffcd9cb346732e…	external
https://git.kernel.org/stable/c/55a65ef61e2775aeb…	external
https://git.kernel.org/stable/c/f721487523d45941a…	external
https://access.redhat.com/security/cve/CVE-2026-99153	self
https://bugzilla.redhat.com/show_bug.cgi?id=2562706	external
https://www.cve.org/CVERecord?id=CVE-2026-99153	external
https://nvd.nist.gov/vuln/detail/CVE-2026-99153	external
https://git.kernel.org/stable/c/7215a69b6456fda79…	external
https://git.kernel.org/stable/c/c5958c770b2a0ee49…	external
https://git.kernel.org/stable/c/d79343ae3223b3f7f…	external
https://access.redhat.com/security/cve/CVE-2026-99999	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553429	external
https://www.cve.org/CVERecord?id=CVE-2026-99999	external
https://nvd.nist.gov/vuln/detail/CVE-2026-99999	external
https://git.kernel.org/pub/scm/linux/security/vul…	external

JSON

To clipboard

Loading 3.6 MB of JSON…

CVE-2026-53196 (GCVE-0-2026-53196)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-11-06 16:24

Title

USB: serial: io_ti: fix heap overflow in get_manuf_info()

Summary

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes. The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver. valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access. Fix by rejecting descriptors with unexpected length before calling read_rom(). [ johan: amend commit message; also check for short descriptors ]

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 16:22 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

21 references

URL	Tags
https://git.kernel.org/stable/c/e168db91442b94e64…
https://git.kernel.org/stable/c/561edb021486e6723…
https://git.kernel.org/stable/c/cfd634f6dfd40c49a…
https://git.kernel.org/stable/c/d92f17af7097d10bd…
https://git.kernel.org/stable/c/b849f30d1a9e66aae…
https://git.kernel.org/stable/c/f96cf7bf9fbf15d7f…
https://git.kernel.org/stable/c/d214d2341d4f9f447…
https://git.kernel.org/stable/c/183c1076eca43bbb3…
https://access.redhat.com/security/cve/CVE-2026-53196	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:67114	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61887	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67723	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65708	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65710	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65711	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65709	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67721	vendor-advisoryx_refsource_REDHAT

Impacted products

19 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e168db91442b94e64fa82a7dd297983d48ea5cc0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 561edb021486e6723d841926aa4b48097da06190 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cfd634f6dfd40c49a84f9bddc2867a80e2e2623a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d92f17af7097d10bdeddf26f66f34b354104b277 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b849f30d1a9e66aae6b715aaef66e427390cb081 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d214d2341d4f9f447e36a7d012cdf6a6631a55f1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 183c1076eca43bbb3e7bdf597456f91d81c73e74 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.50.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.104.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.206.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.206.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.213.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.213.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.166.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.166.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.49.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.191.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.191.1.rt14.476.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.149.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.140.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.104.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.206.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.206.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.213.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.213.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.166.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.166.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.49.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.191.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.191.1.rt14.476.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.149.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.140.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device\u0027s I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T12:04:49.281Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53196"
          },
          {
            "name": "RHBZ#2492750",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53196.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67114"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65708"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65710"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65711"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65709"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67721"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:67114: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67723: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68570: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65710: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65711: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65709: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67721: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T16:22:06.897875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T16:24:06.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/io_ti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e168db91442b94e64fa82a7dd297983d48ea5cc0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "561edb021486e6723d841926aa4b48097da06190",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cfd634f6dfd40c49a84f9bddc2867a80e2e2623a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d92f17af7097d10bdeddf26f66f34b354104b277",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b849f30d1a9e66aae6b715aaef66e427390cb081",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d214d2341d4f9f447e36a7d012cdf6a6631a55f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "183c1076eca43bbb3e7bdf597456f91d81c73e74",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/io_ti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in get_manuf_info()\n\nget_manuf_info() reads le16_to_cpu(rom_desc-\u003eSize) bytes from the\ndevice I2C EEPROM into a buffer allocated with kmalloc_obj(), which\nis sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.\n\nThe Size field comes from the device and is only validated (in\ncheck_i2c_image()) to make sure the descriptor fits within\nTI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.\nA malicious USB device can therefore set Size to any value up to 16377,\ncausing a heap overflow of up to 16367 bytes when plugged into a host\nrunning this driver.\n\nvalid_csum() is called after read_rom() and also iterates\nbuffer[0..Size-1], compounding the out-of-bounds access.\n\nFix by rejecting descriptors with unexpected length before calling\nread_rom().\n\n[ johan: amend commit message; also check for short descriptors ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:39:06.330Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277"
        },
        {
          "url": "https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081"
        },
        {
          "url": "https://git.kernel.org/stable/c/f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74"
        }
      ],
      "title": "USB: serial: io_ti: fix heap overflow in get_manuf_info()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53196",
    "datePublished": "2026-06-25T08:39:06.330Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-11-06T16:24:06.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68140 (GCVE-0-2026-68140)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-10-19 20:58

Title

net/iucv: fix use-after-free of a severed iucv_path

Summary

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:44 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/5f08c5e50bcb46800…
https://git.kernel.org/stable/c/c24faf11bd31bfe05…
https://git.kernel.org/stable/c/99ddb33748698296a…
https://git.kernel.org/stable/c/23658b350b4107e82…
https://git.kernel.org/stable/c/a5bbaddf69853117f…
https://git.kernel.org/stable/c/900cd6d8119b7f3ae…
https://git.kernel.org/stable/c/f579582c03ed52628…
https://git.kernel.org/stable/c/be7cc4656eb1f5402…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f0703c80e5156406ad947cb67fe277725b48080f , < 5f08c5e50bcb4680069bd3f9edd5728308816ded (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < c24faf11bd31bfe0500aca12cbdd5a573a954a5d (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < 99ddb33748698296a6f17b9b34aa3d16a406bb3c (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < 23658b350b4107e8292045c2044983fd426fa15d (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < a5bbaddf69853117f28173c3f5c8fc14c6b2ec82 (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < 900cd6d8119b7f3ae5c4bf82f922ff5957df43db (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < f579582c03ed526281a8450159baf1d35099a85f (git) Affected: f0703c80e5156406ad947cb67fe277725b48080f , < be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a (git)
Linux	Linux	Affected: 2.6.24 Unaffected: 0 , < 2.6.24 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:44:34.964555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:53.121Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f08c5e50bcb4680069bd3f9edd5728308816ded",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "c24faf11bd31bfe0500aca12cbdd5a573a954a5d",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "99ddb33748698296a6f17b9b34aa3d16a406bb3c",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "23658b350b4107e8292045c2044983fd426fa15d",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "a5bbaddf69853117f28173c3f5c8fc14c6b2ec82",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "900cd6d8119b7f3ae5c4bf82f922ff5957df43db",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "f579582c03ed526281a8450159baf1d35099a85f",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            },
            {
              "lessThan": "be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a",
              "status": "affected",
              "version": "f0703c80e5156406ad947cb67fe277725b48080f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv-\u003emessage_q,\neach holding a raw pointer to the connection\u0027s iucv_path.  When the peer\nsevers the connection, iucv_sever_path() frees that path with\niucv_path_free() but leaves the notifications queued.  A later recvmsg()\ndrains message_q via iucv_process_message_q() and hands the stale path to\nmessage_receive() -- a use-after-free of the freed iucv_path.\n\nDrop the queued notifications when the path is severed; once the path is\ngone they can no longer be received.  This also frees the notifications\nleaked when a socket is closed with messages still queued."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An adjacent z/VM guest or LPAR peer can establish an AF_IUCV connection and deliver IUCV message_pending and path_severed events to a victim; exploitation requires same-CPC IUCV reachability, not Internet-wide access.\nAC:L - The attacker deterministically floods IUCV messages to fill message_q, severs the connection to free iucv_path, then victim recvmsg() drains the stale queue; no uncontrollable timing or memory-layout luck is required.\nPR:N - On the victim, no local Linux account or capability is needed; any unauthorized adjacent IUCV peer that completes the AF_IUCV handshake can flood messages and sever the path against a listening service.\nUI:N - No special victim action is required beyond normal server recvmsg() on an established IUCV session; the attacker drives connection setup, message flood, and path sever entirely from the peer side.\nS:U - Impact is kernel memory corruption within the victim Linux guest; it does not cross hypervisor, VM-escape, or IOMMU security boundaries.\nC:H - Queued notifications dereference a freed struct iucv_path in message_receive(), passing stale pathid and private fields into CP IUCV RECEIVE calls\u2014a classic UAF enabling attacker-controlled heap reuse and kernel memory disclosure.\nI:H - Use-after-free of iucv_path lets an attacker reclaim the freed object and supply forged pathid and list pointers used by __iucv_message_receive(), providing heap corruption primitives suitable for arbitrary kernel write or code execution.\nA:H - Processing the stale path in iucv_process_message_q() dereferences freed kernel memory during message_receive(), reliably causing kernel oops or panic and total loss of availability even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:57.127Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f08c5e50bcb4680069bd3f9edd5728308816ded"
        },
        {
          "url": "https://git.kernel.org/stable/c/c24faf11bd31bfe0500aca12cbdd5a573a954a5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/99ddb33748698296a6f17b9b34aa3d16a406bb3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82"
        },
        {
          "url": "https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db"
        },
        {
          "url": "https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f"
        },
        {
          "url": "https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a"
        }
      ],
      "title": "net/iucv: fix use-after-free of a severed iucv_path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68140",
    "datePublished": "2026-08-10T11:59:03.761Z",
    "dateReserved": "2026-07-30T09:28:09.370Z",
    "dateUpdated": "2026-10-19T20:58:53.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68162 (GCVE-0-2026-68162)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-10-19 20:58

Title

sctp: avoid auth_enable sysctl UAF during netns teardown

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid auth_enable sysctl UAF during netns teardown proc_sctp_do_auth() updates the SCTP control socket after changing net.sctp.auth_enable. The handler gets the per-net SCTP state from ctl->data, so an already opened sysctl file can still target a network namespace while that namespace is being torn down. SCTP previously registered its per-net sysctls from sctp_defaults_init(), while the control socket is created later from sctp_ctrlsock_init(). This exposed a window during initialization where auth_enable was writable before net->sctp.ctl_sock existed, and a teardown window where auth_enable stayed writable after inet_ctl_sock_destroy() had released the control socket. Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after sctp_ctl_sock_init() succeeds, and unregister the sysctl table before destroying the control socket in sctp_ctrlsock_exit(). If sysctl registration fails after the control socket was created, destroy the control socket in the same init path. Make sctp_sysctl_net_unregister() tolerate a missing header and clear the saved pointer so init-error and exit paths can safely share the unregister helper.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:45 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/19573dcddb8819fd6…
https://git.kernel.org/stable/c/ceb7190b5c873d4a1…
https://git.kernel.org/stable/c/fd66854a226619292…
https://git.kernel.org/stable/c/158f3cc332dc53f43…
https://git.kernel.org/stable/c/66700c0719675e0e1…
https://git.kernel.org/stable/c/626bda8cfe43dff19…
https://git.kernel.org/stable/c/be6aae9d1b91c603a…
https://git.kernel.org/stable/c/a50e73488e0bbdd26…
https://git.kernel.org/stable/c/f8d5e7846025f4ab1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 10c869a52f266e40f548cc3c565d14930a5edafc , < 19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4 (git) Affected: dc583e7e5f8515ca489c0df28e4362a70eade382 , < ceb7190b5c873d4a1267a1600c5aa52c600e929f (git) Affected: bd2a2939423566c654545fa3e96a656662a0af9e , < fd66854a22661929245f3d2b244c432bc8b1a150 (git) Affected: 1b67030d39f2b00f94ac1f0af11ba6657589e4d3 , < 158f3cc332dc53f43ec20060233d7c3cecd6d912 (git) Affected: 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6 , < 66700c0719675e0e118ae83b2d7168dacd69dd3d (git) Affected: c184bc621e3cef03ac9ba81a50dda2dae6a21d36 , < 626bda8cfe43dff19a9833ff6ba055a817b5455c (git) Affected: 15649fd5415eda664ef35780c2013adeb5d9c695 , < be6aae9d1b91c603adb35872d37d40e83daf8758 (git) Affected: 15649fd5415eda664ef35780c2013adeb5d9c695 , < a50e73488e0bbdd262b3be3c9a1d8dd078382381 (git) Affected: 15649fd5415eda664ef35780c2013adeb5d9c695 , < f8d5e7846025f4ab15a461235f8ebae9094a361a (git) Affected: 5.4.290 , < 5.4.292 (semver) Affected: 5.10.234 , < 5.10.266 (semver) Affected: 5.15.177 , < 5.15.217 (semver) Affected: 6.1.125 , < 6.1.184 (semver) Affected: 6.6.72 , < 6.6.151 (semver) Affected: 6.12.10 , < 6.12.101 (semver)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 5.4.292 , ≤ 5.4.* (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:45:25.940723Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:55.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/protocol.c",
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4",
              "status": "affected",
              "version": "10c869a52f266e40f548cc3c565d14930a5edafc",
              "versionType": "git"
            },
            {
              "lessThan": "ceb7190b5c873d4a1267a1600c5aa52c600e929f",
              "status": "affected",
              "version": "dc583e7e5f8515ca489c0df28e4362a70eade382",
              "versionType": "git"
            },
            {
              "lessThan": "fd66854a22661929245f3d2b244c432bc8b1a150",
              "status": "affected",
              "version": "bd2a2939423566c654545fa3e96a656662a0af9e",
              "versionType": "git"
            },
            {
              "lessThan": "158f3cc332dc53f43ec20060233d7c3cecd6d912",
              "status": "affected",
              "version": "1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
              "versionType": "git"
            },
            {
              "lessThan": "66700c0719675e0e118ae83b2d7168dacd69dd3d",
              "status": "affected",
              "version": "7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
              "versionType": "git"
            },
            {
              "lessThan": "626bda8cfe43dff19a9833ff6ba055a817b5455c",
              "status": "affected",
              "version": "c184bc621e3cef03ac9ba81a50dda2dae6a21d36",
              "versionType": "git"
            },
            {
              "lessThan": "be6aae9d1b91c603adb35872d37d40e83daf8758",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "a50e73488e0bbdd262b3be3c9a1d8dd078382381",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "f8d5e7846025f4ab15a461235f8ebae9094a361a",
              "status": "affected",
              "version": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.292",
              "status": "affected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.266",
              "status": "affected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/protocol.c",
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "5.4.290",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.10.234",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.177",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered only by writing the per-net sysctl net.sctp.auth_enable via /proc/sys (proc_sctp_do_auth); it is not reachable from SCTP packet receive, sockets, or other remote protocol paths.\nAC:L - An attacker can open the sysctl file, concurrently destroy the target network namespace, and repeatedly write during teardown; pernet exit destroys ctl_sock before unregistering sysctls, and the attacker controls both sides of that race.\nPR:L - Exploitation requires writing a mode 0644 sysctl in a network namespace; an unprivileged host user with CAP_NET_ADMIN via user namespaces can create a netns, become namespace root, and write net/sctp/auth_enable without init-namespace privileges.\nUI:N - No victim interaction is required beyond the attacker opening the sysctl and triggering namespace teardown in their own threads or processes.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same host/kernel security domain; it does not cross VM, container, or IOMMU boundaries by itself.\nC:H - proc_sctp_do_auth dereferences net-\u003esctp.ctl_sock after inet_ctl_sock_destroy; lock_sock and sctp_sk(sk)-\u003eep access freed socket/endpoint memory, a use-after-free that can disclose or infer heap contents.\nI:H - On a successful write, the handler sets sctp_sk(sk)-\u003eep-\u003eauth_enable on a freed endpoint object, giving a controlled heap write primitive that can be developed into arbitrary kernel modification or code execution.\nA:H - Use-after-free on the SCTP control socket/endpoint during sysctl processing can cause kernel oops/panic from lock_sock or ep access on freed memory, even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:01.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150"
        },
        {
          "url": "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912"
        },
        {
          "url": "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c"
        },
        {
          "url": "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758"
        },
        {
          "url": "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a"
        }
      ],
      "title": "sctp: avoid auth_enable sysctl UAF during netns teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68162",
    "datePublished": "2026-08-10T11:59:29.099Z",
    "dateReserved": "2026-07-30T09:28:09.372Z",
    "dateUpdated": "2026-10-19T20:58:55.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68451 (GCVE-0-2026-68451)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:59 – Updated: 2026-10-19 21:09

Title

s390/zcrypt: Validate length for CCA ECC private key requests

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:49 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7dc306ff7c4d95158…
https://git.kernel.org/stable/c/447a37a6bef11bfd3…
https://git.kernel.org/stable/c/f0831f13c42c1261d…
https://git.kernel.org/stable/c/dd25bd9b0f3684980…
https://git.kernel.org/stable/c/ecc3b8691c1935f9f…
https://git.kernel.org/stable/c/013a4484f061a2b41…
https://git.kernel.org/stable/c/8fa3e9435a13c335e…
https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 7dc306ff7c4d951582adaae65e0aee9fb4968dbe (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 447a37a6bef11bfd3645069e380460b11386e2b9 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < f0831f13c42c1261d449dcee8a035e1c6cd9fcaa (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 013a4484f061a2b41f052e25c0015203287e63f1 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < 8fa3e9435a13c335efb63fb4f4e77531a0031159 (git) Affected: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 , < a9ae0f6dd45c3ccc1d69363f7aea8af179122730 (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:11.874669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:10.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7dc306ff7c4d951582adaae65e0aee9fb4968dbe",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "447a37a6bef11bfd3645069e380460b11386e2b9",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "f0831f13c42c1261d449dcee8a035e1c6cd9fcaa",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "013a4484f061a2b41f052e25c0015203287e63f1",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "8fa3e9435a13c335efb63fb4f4e77531a0031159",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            },
            {
              "lessThan": "a9ae0f6dd45c3ccc1d69363f7aea8af179122730",
              "status": "affected",
              "version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA ECC private key requests\n\ncca_ecc2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the `/dev/pkey` misc device via the PKEY_KBLOB2PROTK/PROTK2/PROTK3 ioctls, requiring local access to the s390 system; there is no remote or network-facing path into cca_ecc2protkey().\nAC:L - The attacker fully controls both the overflow length and the overflowing bytes by crafting the ECC key token\u0027s `len` field and blob contents, and the memcpy executes deterministically on every call with no race, timing, or layout precondition.\nPR:L - The pkey misc device is registered with mode 0666 and pkey_unlocked_ioctl performs no capability check, so any unprivileged local user (or a container/sandbox process with the node visible) can issue the ioctl.\nUI:N - The attacker triggers the overflow entirely from its own ioctl call; no action by another user or administrator is needed.\nS:U - The heap corruption occurs in kernel memory within the same security authority; no VM, IOMMU, or other trust boundary is crossed by the overflow itself.\nC:H - The controlled slab overflow can overwrite adjacent kernel objects (pointers, lengths, credentials) with attacker-chosen data, which is readily leveraged into arbitrary kernel memory disclosure, including protected/secure key material handled by this subsystem.\nI:H - memcpy() writes up to ~7 KB of fully attacker-controlled data past a kmalloc\u0027d CPRB buffer, giving a classic controlled heap out-of-bounds write usable for corrupting neighbouring slab objects and achieving privilege escalation or control-flow hijack.\nA:H - Even without reliable exploitation, the oversized memcpy smashes the slab and neighbouring allocations, causing memory corruption, SLUB/redzone BUG detonations, oops or kernel panic, repeatedly triggerable by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:48.084Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7dc306ff7c4d951582adaae65e0aee9fb4968dbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/447a37a6bef11bfd3645069e380460b11386e2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0831f13c42c1261d449dcee8a035e1c6cd9fcaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730"
        }
      ],
      "title": "s390/zcrypt: Validate length for CCA ECC private key requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68451",
    "datePublished": "2026-08-13T13:59:53.674Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-10-19T21:09:10.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68452 (GCVE-0-2026-68452)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:59 – Updated: 2026-10-19 21:09

Title

s390/zcrypt: Validate length for CCA AES cipher key requests

Summary

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:49 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/be037204e4f595e4b…
https://git.kernel.org/stable/c/4e500ecb6704d879f…
https://git.kernel.org/stable/c/7f9e5a3dbb14a9b32…
https://git.kernel.org/stable/c/406b317ea2b501f6f…
https://git.kernel.org/stable/c/4fc46deceda076d42…
https://git.kernel.org/stable/c/ad93a1f1a45652478…
https://git.kernel.org/stable/c/3859f630b674801a0…
https://git.kernel.org/stable/c/06afe425d5283b976…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < be037204e4f595e4bd2159acda146677a1dc6342 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 4e500ecb6704d879f9c2417c2ed6faba595015ca (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 7f9e5a3dbb14a9b321a1dfa30390402c673f82dc (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 406b317ea2b501f6f5eca1264293c9399a73a778 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 4fc46deceda076d429ef3fab2ccf8d96629ebd23 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < ad93a1f1a45652478c0cf4eb029114e03af57f3b (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 3859f630b674801a00bca39bc451f52288591f65 (git) Affected: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd , < 06afe425d5283b9764303de47f554da5a808ce8a (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:15.916334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:11.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be037204e4f595e4bd2159acda146677a1dc6342",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "4e500ecb6704d879f9c2417c2ed6faba595015ca",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "7f9e5a3dbb14a9b321a1dfa30390402c673f82dc",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "406b317ea2b501f6f5eca1264293c9399a73a778",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "4fc46deceda076d429ef3fab2ccf8d96629ebd23",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "ad93a1f1a45652478c0cf4eb029114e03af57f3b",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "3859f630b674801a00bca39bc451f52288591f65",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            },
            {
              "lessThan": "06afe425d5283b9764303de47f554da5a808ce8a",
              "status": "affected",
              "version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/zcrypt_ccamisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA AES cipher key requests\n\ncca_cipher2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through an ioctl (PKEY_KBLOB2PROTK2/3) on the /dev/pkey character device, requiring local access to the s390 system; there is no remote or adjacent-network path to cca_cipher2protkey().\nAC:L - The overflow is fully deterministic: the attacker sets the token\u0027s len field to any value up to the 8192-byte ioctl limit and the memcpy into the 512-byte parameter block happens unconditionally, before any crypto card interaction, with no race or unknown state involved.\nPR:L - The pkey misc device is registered with .mode = 0666 and neither pkey_api.c, pkey_base.c nor pkey_cca.c performs any capable()/CAP_* check, so any unprivileged local user can open it and issue the key-to-protkey ioctl.\nUI:N - The attacker triggers the overflow entirely on its own by issuing the ioctl with a crafted CCA AES cipher key token; no victim action or cooperation is needed.\nS:U - The heap corruption occurs in kernel slab memory managed by the same kernel security authority as the calling process; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The controlled slab overflow (up to ~7.6 KB past a kmalloc-2k object) lets the attacker overwrite adjacent kernel objects, and the corrupted CPRB/reply buffer is subsequently parsed and partially copied back to userspace, giving a path to disclosing arbitrary kernel memory.\nI:H - memcpy() writes attacker-chosen token bytes far beyond the 512-byte parameter block, an out-of-bounds heap write with attacker-controlled length and contents, which is a classic primitive for corrupting neighbouring slab objects and hijacking control flow.\nA:H - Overwriting several kilobytes of adjacent slab memory reliably corrupts unrelated kernel objects and slab metadata, causing oopses or a panic; the ioctl can be repeated at will by any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:50.661Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be037204e4f595e4bd2159acda146677a1dc6342"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e500ecb6704d879f9c2417c2ed6faba595015ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f9e5a3dbb14a9b321a1dfa30390402c673f82dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65"
        },
        {
          "url": "https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a"
        }
      ],
      "title": "s390/zcrypt: Validate length for CCA AES cipher key requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68452",
    "datePublished": "2026-08-13T13:59:54.840Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-10-19T21:09:11.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72221 (GCVE-0-2026-72221)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-10-16 18:45

Title

sunrpc: wait for in-flight TLS handshake callback when cancel loses race

Summary

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When wait_for_completion_interruptible_timeout() in svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and tls_handshake_cancel() then returns false, handshake_complete() has won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and is about to invoke svc_tcp_handshake_done(), but the callback's side effects on xpt_flags and on svsk->sk_handshake_done have not yet committed. The current code reads xpt_flags immediately to decide whether the session succeeded. Two races result. If the callback has executed set_bit(XPT_TLS_SESSION) but not yet clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session, enqueues the transport, and returns. svc_xprt_received() then clears XPT_BUSY, a worker thread picks the transport up, the dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set, and xpo_handshake is invoked a second time. That svc_tcp_handshake() calls init_completion(&svsk->sk_handshake_done) while the original callback concurrently calls complete_all() on it, corrupting the embedded swait_queue. If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet entered svc_tcp_handshake_done(), svc_tcp_handshake() reads XPT_TLS_SESSION as clear and tears the connection down even though the handshake is about to succeed. Wait for the callback to commit before inspecting xpt_flags. The completion is guaranteed to fire because handshake_complete() invokes svc_tcp_handshake_done() unconditionally once it has set HANDSHAKE_F_REQ_COMPLETED.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:43 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/0d8ceb39884148dc7…
https://git.kernel.org/stable/c/e0f4691d42a54d359…
https://git.kernel.org/stable/c/65b23bec1fca6e9eb…
https://git.kernel.org/stable/c/a4f878e8ecd729ccf…
https://git.kernel.org/stable/c/d00e32f84ca1a77cb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < 0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9 (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < e0f4691d42a54d359d8b64509fd9ab938d4f2a33 (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < 65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < a4f878e8ecd729ccf2e50993444e217583adeace (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72221",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:43:57.343257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:45:02.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "e0f4691d42a54d359d8b64509fd9ab938d4f2a33",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "a4f878e8ecd729ccf2e50993444e217583adeace",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "d00e32f84ca1a77cb67a3fbf59f58dada95f5a21",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: wait for in-flight TLS handshake callback when cancel loses race\n\nWhen wait_for_completion_interruptible_timeout() in\nsvc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and\ntls_handshake_cancel() then returns false, handshake_complete() has\nwon the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and\nis about to invoke svc_tcp_handshake_done(), but the callback\u0027s\nside effects on xpt_flags and on svsk-\u003esk_handshake_done have not\nyet committed.\n\nThe current code reads xpt_flags immediately to decide whether the\nsession succeeded. Two races result.\n\nIf the callback has executed set_bit(XPT_TLS_SESSION) but not yet\nclear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,\nenqueues the transport, and returns. svc_xprt_received() then\nclears XPT_BUSY, a worker thread picks the transport up, the\ndispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,\nand xpo_handshake is invoked a second time. That svc_tcp_handshake()\ncalls init_completion(\u0026svsk-\u003esk_handshake_done) while the original\ncallback concurrently calls complete_all() on it, corrupting the\nembedded swait_queue.\n\nIf the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet\nentered svc_tcp_handshake_done(), svc_tcp_handshake() reads\nXPT_TLS_SESSION as clear and tears the connection down even though\nthe handshake is about to succeed.\n\nWait for the callback to commit before inspecting xpt_flags. The\ncompletion is guaranteed to fire because handshake_complete()\ninvokes svc_tcp_handshake_done() unconditionally once it has set\nHANDSHAKE_F_REQ_COMPLETED."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:42.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33"
        },
        {
          "url": "https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace"
        },
        {
          "url": "https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21"
        }
      ],
      "title": "sunrpc: wait for in-flight TLS handshake callback when cancel loses race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72221",
    "datePublished": "2026-08-15T05:54:14.539Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-10-16T18:45:02.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72222 (GCVE-0-2026-72222)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-10-16 18:45

Title

sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

Summary

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback svc_tcp_handshake() stores the raw svc_xprt pointer in tls_handshake_args.ta_data and submits the request through tls_server_hello_x509(). The handshake core takes only sock_hold(req->hr_sk); nothing references the embedding struct svc_sock that svc_tcp_handshake_done() reaches via container_of(). Two close races leave the in-flight callback writing through a freed svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards its return value: a false return means handshake_complete() has already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have finished, yet svc_sock_free() proceeds to kfree(svsk). The cancel-loser fall-through inside svc_tcp_handshake() itself produces the same window: when wait_for_completion_interruptible_timeout() returns <= 0 (timeout or signal) and tls_handshake_cancel() returns false, the function does not drain, returns, and svc_handle_xprt() calls svc_xprt_received(), which clears XPT_BUSY and can drop the last reference. A concurrent close then runs svc_sock_free() while svc_tcp_handshake_done() is still updating xpt_flags and walking svsk->sk_handshake_done. The corruption surfaces as set_bit/clear_bit RMW into the freed xpt_flags slab slot and as complete_all() walking and writing the freed wait_queue_head_t list embedded in sk_handshake_done -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVC_HANDSHAKE_TO expiry. Take svc_xprt_get(xprt) immediately before tls_server_hello_x509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tls_server_hello_x509() and a successful tls_handshake_cancel() -- and at the tail of svc_tcp_handshake_done() after complete_all(). [cel: rewrote commit message to describe the actual change]

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:44 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/f3b55945dd99f29d8…
https://git.kernel.org/stable/c/2d4f97d13fff91e0b…
https://git.kernel.org/stable/c/3f9ee75a97a769be2…
https://git.kernel.org/stable/c/083e9c2ec7e8bb13b…
https://git.kernel.org/stable/c/4f988f3a2808fb659…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < f3b55945dd99f29d83e1965d0141040a35262346 (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < 2d4f97d13fff91e0bc539216be88b884b544d49f (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < 3f9ee75a97a769be258784c22b89657acb5ed9bd (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < 083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f (git) Affected: b3cbf98e2fdf3cb147a95161560cd25987284330 , < 4f988f3a2808fb659f3880c282041ff067acad78 (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72222",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:44:02.358946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:45:02.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3b55945dd99f29d83e1965d0141040a35262346",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "2d4f97d13fff91e0bc539216be88b884b544d49f",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "3f9ee75a97a769be258784c22b89657acb5ed9bd",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            },
            {
              "lessThan": "4f988f3a2808fb659f3880c282041ff067acad78",
              "status": "affected",
              "version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svcsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: pin svc_xprt across the asynchronous TLS handshake callback\n\nsvc_tcp_handshake() stores the raw svc_xprt pointer in\ntls_handshake_args.ta_data and submits the request through\ntls_server_hello_x509(). The handshake core takes only\nsock_hold(req-\u003ehr_sk); nothing references the embedding struct\nsvc_sock that svc_tcp_handshake_done() reaches via container_of().\n\nTwo close races leave the in-flight callback writing through a freed\nsvc_sock. svc_sock_free() calls tls_handshake_cancel() and discards\nits return value: a false return means handshake_complete() has\nalready set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have\nfinished, yet svc_sock_free() proceeds to kfree(svsk). The\ncancel-loser fall-through inside svc_tcp_handshake() itself produces\nthe same window: when wait_for_completion_interruptible_timeout()\nreturns \u003c= 0 (timeout or signal) and tls_handshake_cancel() returns\nfalse, the function does not drain, returns, and svc_handle_xprt()\ncalls svc_xprt_received(), which clears XPT_BUSY and can drop the\nlast reference. A concurrent close then runs svc_sock_free() while\nsvc_tcp_handshake_done() is still updating xpt_flags and walking\nsvsk-\u003esk_handshake_done.\n\nThe corruption surfaces as set_bit/clear_bit RMW into the freed\nxpt_flags slab slot and as complete_all() walking and writing the\nfreed wait_queue_head_t list embedded in sk_handshake_done -- a\nslab-corruption primitive, not a benign read. The path is reachable\non any TLS-enabled NFS server whenever a connection close overlaps\nthe tlshd downcall delivery window; the interruptible wait means\nsignal delivery suffices, not just SVC_HANDSHAKE_TO expiry.\n\nTake svc_xprt_get(xprt) immediately before tls_server_hello_x509()\nso the in-flight callback owns its own reference. Release it on the\ntwo edges where the callback is guaranteed not to fire -- submission\nfailure from tls_server_hello_x509() and a successful\ntls_handshake_cancel() -- and at the tail of\nsvc_tcp_handshake_done() after complete_all().\n\n[cel: rewrote commit message to describe the actual change]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd\u0027s server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel\u0027s security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:44.196Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78"
        }
      ],
      "title": "sunrpc: pin svc_xprt across the asynchronous TLS handshake callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72222",
    "datePublished": "2026-08-15T05:54:15.277Z",
    "dateReserved": "2026-08-09T03:40:39.913Z",
    "dateUpdated": "2026-10-16T18:45:02.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74385 (GCVE-0-2026-74385)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:59 – Updated: 2026-10-21 12:45

Title

nvmet-tcp: check return value of nvmet_tcp_set_queue_sock

Summary

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock The return value of nvmet_tcp_set_queue_sock() is currently ignored in nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket not being in TCP_ESTABLISHED state), the socket callbacks will not be properly set, leading to queue and socket leakage. Fix this by capturing the return value and calling nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 18:55 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/41b63ff99e3ef37d0…
https://git.kernel.org/stable/c/cba2ee57fd302727a…
https://git.kernel.org/stable/c/22aa70f9a0544643e…
https://git.kernel.org/stable/c/7ef789703e2b91775…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 41b63ff99e3ef37d08f3693413dae5ede5e79fe1 (git) Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < cba2ee57fd302727aea7d41e9d9cd0969f5df0fb (git) Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 22aa70f9a0544643ec37d442b6fcb1833d804462 (git) Affected: 675b453e024154dd547921c6e6d5b58747ba7e0e , < 7ef789703e2b91775dcb36b2efa46325be31a2a0 (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:55:01.310630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:55:36.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "41b63ff99e3ef37d08f3693413dae5ede5e79fe1",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            },
            {
              "lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
              "status": "affected",
              "version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nvmet-tcp, an in-kernel NVMe-over-TCP target that accepts remote TCP connections; the bug triggers in nvmet_tcp_tls_handshake_done() after tls_server_hello_psk() completes, reachable from any network peer that can connect to an exposed NVMe-oF TLS port (typical cloud/storage-server deployment).\nAC:L - An attacker controls both sides of the race by completing the TLS handshake and then closing or resetting the TCP connection so the socket is no longer TCP_ESTABLISHED when nvmet_tcp_set_queue_sock() runs; this is reliably repeatable across new connections without conditions outside attacker control.\nPR:N - Exploitation requires only network reachability to the NVMe-oF TCP target port; no Linux credentials, capabilities, or init-namespace root are needed, and the vulnerable path runs after TCP accept but before NVMe Connect, host NQN allow-list, or DH-HMAC-CHAP in-band authentication.\nUI:N - No victim user action is required; the attacker programmatically opens TLS connections to the NVMe target and times disconnects to hit the failure path, with no need for local users to mount filesystems or perform other interactive steps.\nS:U - Impact is confined to kernel resource exhaustion within the host running the NVMe target; leaked queues and sockets do not cross VM, container, or IOMMU security boundaries and do not constitute privilege escalation beyond the target kernel itself.\nC:N - The defect is a missed cleanup that leaks queue structures, sockets, and TLS key references; there is no use-after-free, out-of-bounds access, or other memory corruption that could expose kernel data to the attacker.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug only leaves queue and socket objects allocated without installing socket callbacks or scheduling proper teardown.\nA:H - Each successful trigger permanently leaks an nvmet_tcp_queue, socket/file reference, and IDA slot with no automatic recovery; repeated unauthenticated connections can exhaust kernel memory and socket resources, denying NVMe-oF service on internet-facing storage nodes until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:45:33.852Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/41b63ff99e3ef37d08f3693413dae5ede5e79fe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
        }
      ],
      "title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74385",
    "datePublished": "2026-08-15T05:59:01.113Z",
    "dateReserved": "2026-08-15T05:44:03.890Z",
    "dateUpdated": "2026-10-21T12:45:33.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74586 (GCVE-0-2026-74586)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-10-16 19:05

Title

sctp: clear new_transport when removing a peer

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the new transport. An authenticated ASCONF from a remote SCTP peer can add a transport and remove it again with a wildcard DEL-IP parameter in the same chunk. The wildcard deletion preserves the transport on which the ASCONF arrived, but removes the newly added transport through sctp_assoc_del_nonprimary_peers(). The removal does not clear asoc->new_transport, leaving it pointing to the removed transport. sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points to the removed transport without holding a transport reference. During local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on control_chunk_list. After the transport is freed by RCU, a successful ASCONF_ACK for the replacement address releases the queued HEARTBEAT and sctp_outq_select_transport() reads the freed transport's state. The issue was found during a static audit of SCTP objects. With an authenticated peer, the reproducer triggered the same KASAN report in 2 of 2 unpatched runs on a KASAN-enabled netdev/main kernel: BUG: KASAN: slab-use-after-free in sctp_outq_select_transport Read of size 4 at addr ffff88800b9bd95c by task python3/197 Call Trace: sctp_outq_select_transport+0x549/0x8b0 [sctp] sctp_outq_flush+0x306/0x2c60 [sctp] sctp_transport_immediate_rtx+0xaf/0x260 [sctp] sctp_process_asconf_ack+0xa48/0xf70 [sctp] Allocated by task 197: sctp_transport_new+0x68/0x650 [sctp] sctp_assoc_add_peer+0x258/0x12a0 [sctp] sctp_process_asconf+0x5e9/0x1090 [sctp] Last potentially related work creation: __call_rcu_common.constprop.0+0x77/0xb70 sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp] sctp_process_asconf+0xd9c/0x1090 [sctp] The first invalid access was a four-byte read of transport->state at net/sctp/outqueue.c:833. The same reproducer completed the full authenticated ASCONF and local-address replacement sequence with this change without a KASAN report or oops. Clear new_transport when its peer is removed, before it can be used to create the HEARTBEAT.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 19:01 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c0f973bb5118dd1b1…
https://git.kernel.org/stable/c/3b539b317cd052236…
https://git.kernel.org/stable/c/db9d8e3b670f84175…
https://git.kernel.org/stable/c/31efa656cf6aface2…
https://git.kernel.org/stable/c/291accf36febce751…
https://git.kernel.org/stable/c/ca33df36aa0143a1d…
https://git.kernel.org/stable/c/163847552a571bd55…
https://git.kernel.org/stable/c/beb33f8ee1ca83acd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < c0f973bb5118dd1b146cda3fcc8af6f6057befec (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 3b539b317cd052236fed0350364ff1268996ba46 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < db9d8e3b670f841755bc2018f178472dc6064d27 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 31efa656cf6aface26e88f038c14f22ee6ca1500 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 291accf36febce751021888de5f15090f4875b56 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < ca33df36aa0143a1d04f57d2086020c12e7eddb7 (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < 163847552a571bd55094291f4ffcdc1de0f14a7b (git) Affected: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf , < beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3 (git)
Linux	Linux	Affected: 3.2 Unaffected: 0 , < 3.2 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:01:22.679570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:58.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0f973bb5118dd1b146cda3fcc8af6f6057befec",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "3b539b317cd052236fed0350364ff1268996ba46",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "db9d8e3b670f841755bc2018f178472dc6064d27",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "31efa656cf6aface26e88f038c14f22ee6ca1500",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "291accf36febce751021888de5f15090f4875b56",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "ca33df36aa0143a1d04f57d2086020c12e7eddb7",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "163847552a571bd55094291f4ffcdc1de0f14a7b",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            },
            {
              "lessThan": "beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3",
              "status": "affected",
              "version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear new_transport when removing a peer\n\nsctp_process_asconf_param() stores a newly added peer transport in\nasoc-\u003enew_transport. After all parameters in the ASCONF chunk have been\nprocessed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the\nnew transport.\n\nAn authenticated ASCONF from a remote SCTP peer can add a transport and\nremove it again with a wildcard DEL-IP parameter in the same chunk. The\nwildcard deletion preserves the transport on which the ASCONF arrived, but\nremoves the newly added transport through\nsctp_assoc_del_nonprimary_peers(). The removal does not clear\nasoc-\u003enew_transport, leaving it pointing to the removed transport.\n\nsctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u003etransport points\nto the removed transport without holding a transport reference. During\nlocal address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on\ncontrol_chunk_list. After the transport is freed by RCU, a successful\nASCONF_ACK for the replacement address releases the queued HEARTBEAT and\nsctp_outq_select_transport() reads the freed transport\u0027s state.\n\nThe issue was found during a static audit of SCTP objects. With an\nauthenticated peer, the reproducer triggered the same KASAN report in 2\nof 2 unpatched runs on a KASAN-enabled netdev/main kernel:\n\n  BUG: KASAN: slab-use-after-free in sctp_outq_select_transport\n  Read of size 4 at addr ffff88800b9bd95c by task python3/197\n\n  Call Trace:\n   sctp_outq_select_transport+0x549/0x8b0 [sctp]\n   sctp_outq_flush+0x306/0x2c60 [sctp]\n   sctp_transport_immediate_rtx+0xaf/0x260 [sctp]\n   sctp_process_asconf_ack+0xa48/0xf70 [sctp]\n\n  Allocated by task 197:\n   sctp_transport_new+0x68/0x650 [sctp]\n   sctp_assoc_add_peer+0x258/0x12a0 [sctp]\n   sctp_process_asconf+0x5e9/0x1090 [sctp]\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x77/0xb70\n   sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]\n   sctp_process_asconf+0xd9c/0x1090 [sctp]\n\nThe first invalid access was a four-byte read of transport-\u003estate at\nnet/sctp/outqueue.c:833. The same reproducer completed the full\nauthenticated ASCONF and local-address replacement sequence with this\nchange without a KASAN report or oops.\n\nClear new_transport when its peer is removed, before it can be used to\ncreate the HEARTBEAT."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered when a remote SCTP peer sends an authenticated ASCONF chunk that is processed via sctp_rcv() through the state machine into sctp_sf_do_asconf() and sctp_process_asconf(); this is standard network packet handling, not a local syscall or ioctl path.\nAC:L - The remote peer fully controls a single ASCONF containing ADD_IP followed by wildcard DEL-IP to add then remove a transport while leaving asoc-\u003enew_transport dangling; combined with routine SCTP local address replacement (src_out_of_asoc_ok), the KASAN reproducer hit the UAF in 2/2 runs.\nPR:N - Exploitation requires only being an established SCTP association peer sending SCTP-AUTH-protected ASCONF traffic negotiated during the normal handshake (or addip_noauth); no Linux account, capability, or init-namespace privilege is needed on the victim host.\nUI:N - No victim user action such as opening a file or mounting a filesystem is required; the kernel automatically processes attacker-crafted ASCONF packets on an existing SCTP association during normal server operation.\nS:U - Impact is confined to kernel heap corruption on the vulnerable host (slab UAF on sctp_transport) and potential privilege escalation within that kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - KASAN reports slab-use-after-free with a 4-byte read of freed sctp_transport-\u003estate in sctp_outq_select_transport(); UAF on heap transport objects enables grooming for arbitrary kernel memory disclosure per kernel CVSS guidance.\nI:H - The dangling sctp_transport pointer is embedded in a queued HEARTBEAT control chunk without a reference; UAF on this heap object can be leveraged via heap spraying for arbitrary kernel writes and control-flow hijacking, not merely a bounded corruption.\nA:H - Dereferencing the freed transport during sctp_outq_flush() causes a reproducible kernel UAF/oops; remote peers can repeatedly trigger this against SCTP endpoints handling ADD-IP traffic, yielding denial of service or crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:12.552Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0f973bb5118dd1b146cda3fcc8af6f6057befec"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b539b317cd052236fed0350364ff1268996ba46"
        },
        {
          "url": "https://git.kernel.org/stable/c/db9d8e3b670f841755bc2018f178472dc6064d27"
        },
        {
          "url": "https://git.kernel.org/stable/c/31efa656cf6aface26e88f038c14f22ee6ca1500"
        },
        {
          "url": "https://git.kernel.org/stable/c/291accf36febce751021888de5f15090f4875b56"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca33df36aa0143a1d04f57d2086020c12e7eddb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/163847552a571bd55094291f4ffcdc1de0f14a7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3"
        }
      ],
      "title": "sctp: clear new_transport when removing a peer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74586",
    "datePublished": "2026-08-22T15:31:39.094Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-10-16T19:05:58.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74588 (GCVE-0-2026-74588)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:31 – Updated: 2026-10-16 19:05

Title

sctp: keep chunk->transport in step with the list it is queued on

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the removal and the SACKs come from the association peer. Set chunk->transport at the move. The ordinary resend path needs nothing: it reaches its list_move_tail() only after sctp_packet_append_chunk() returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the chunk by then. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 19:01 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/6575fb17230814b48…
https://git.kernel.org/stable/c/6b9e2ea2057113f33…
https://git.kernel.org/stable/c/874a7c2b5e184f061…
https://git.kernel.org/stable/c/1adf929121e13e0b1…
https://git.kernel.org/stable/c/e2e7c1de0e226ca1b…
https://git.kernel.org/stable/c/2b3b5eec8b2c30ee2…
https://git.kernel.org/stable/c/5ccf35ef0ed6059cd…
https://git.kernel.org/stable/c/9f2cf069a9a72a2d6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6575fb17230814b48b471727c8410c0aadff9274 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6b9e2ea2057113f3393990ba646d2d97c719a80d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 874a7c2b5e184f06134fdfde27e9ce9271bafe58 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1adf929121e13e0b19200bb9fef715b918d483fe (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e2e7c1de0e226ca1b7fea2de57a6c9bca408709b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9f2cf069a9a72a2d6b97ca8b4c70e714aac99749 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:01:29.030905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:59.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/outqueue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6575fb17230814b48b471727c8410c0aadff9274",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6b9e2ea2057113f3393990ba646d2d97c719a80d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "874a7c2b5e184f06134fdfde27e9ce9271bafe58",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1adf929121e13e0b19200bb9fef715b918d483fe",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e2e7c1de0e226ca1b7fea2de57a6c9bca408709b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f2cf069a9a72a2d6b97ca8b4c70e714aac99749",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/outqueue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk-\u003etransport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport\u0027s\ntransmitted list without updating chunk-\u003etransport:\n\n\tif (chunk-\u003etsn_gap_acked) {\n\t\tlist_move_tail(\u0026chunk-\u003etransmitted_list,\n\t\t\t       \u0026transport-\u003etransmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport\u0027s list while chunk-\u003etransport still\nnames a different one.  If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer.  sctp_assoc_rm_peer() scrubs\npeer-\u003etransmitted and asoc-\u003eoutqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set.  A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk-\u003etransport-\u003eflight_size -= sctp_data_size(tchunk);\n\ninside the freed transport.  KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer().  Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk-\u003etransport at the move.  The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when the kernel SCTP stack processes inbound SACK and ASCONF chunks from a remote association peer via sctp_rcv()/sctp_inq_push(), with no local syscall or ioctl required on the victim.\nAC:L - The remote peer controls the SCTP protocol sequence (gap SACKs, ADDIP multihoming, ASCONF Delete-IP, and SACK reneging) needed to strand a chunk and free its transport; no attacker-uncontrollable race or rare memory layout is required.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted SACK and ASCONF packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - KASAN reports a slab use-after-free read through dangling chunk-\u003etransport in sctp_check_transmitted(); UAF on sctp_transport objects can be groomed for arbitrary kernel memory disclosure.\nI:H - The UAF dereference performs flight_size arithmetic on a freed sctp_transport slab object, enabling heap grooming and arbitrary kernel write or control-flow hijack primitives typical of SCTP transport UAFs.\nA:H - Accessing freed transport memory during SACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:15.097Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d"
        },
        {
          "url": "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58"
        },
        {
          "url": "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749"
        }
      ],
      "title": "sctp: keep chunk-\u003etransport in step with the list it is queued on",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74588",
    "datePublished": "2026-08-22T15:31:40.466Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-10-16T19:05:59.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:99135

CVE-2026-53196 (GCVE-0-2026-53196)

CVE-2026-68140 (GCVE-0-2026-68140)

CVE-2026-68162 (GCVE-0-2026-68162)

CVE-2026-68451 (GCVE-0-2026-68451)

CVE-2026-68452 (GCVE-0-2026-68452)

CVE-2026-72221 (GCVE-0-2026-72221)

CVE-2026-72222 (GCVE-0-2026-72222)

CVE-2026-74385 (GCVE-0-2026-74385)

CVE-2026-74586 (GCVE-0-2026-74586)

CVE-2026-74588 (GCVE-0-2026-74588)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour