{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/rfcomm/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5ec76bdbeb80f75ad0be204371afffee0f8fac8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a07d741c077d4e34b16458241a94d29039386553",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1f73f92f66251065a5f39b09a47cf05ea14d3107",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "de31973ef00e5aa55496f84cf6a44bb157a34e02",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b0e33e409715c617e2a20f46f99aa5403a14dfda",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8802413ce63175fb522a2bd609fb043a3550c720",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6f4462d12133106460d7c046b95aad2491e3fddf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "43c441edacf953b39517a44f5e5e10a93618b226",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/rfcomm/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()\n\nrfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,\nbut returns the selected listener after dropping that lock without\ntaking a reference. rfcomm_connect_ind() then locks the listener,\nqueues a child socket on it, and may notify it after unlocking it.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nrfcomm_connect_ind():            listener close:\n  1. Find parent in              1. close() enters\n     rfcomm_get_sock_by_channel()   rfcomm_sock_release().\n  2. Drop rfcomm_sk_list.lock    2. rfcomm_sock_shutdown()\n     without pinning parent.        closes the listener.\n  3. Call lock_sock(parent) and  3. rfcomm_sock_kill()\n     bt_accept_enqueue(parent,      unlinks and puts parent.\n     sk, true).\n  4. Read parent flags and may   4. parent can be freed.\n     call sk_state_change().\n\nIf close wins the race, parent can be freed before\nrfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the\ndeferred-setup callback.\n\nTake a reference on the listener before leaving rfcomm_sk_list.lock.\nAfter lock_sock() succeeds, recheck that it is still in BT_LISTEN\nbefore queueing a child, cache the deferred-setup bit while the parent\nis locked, and drop the reference after the last parent use.\n\nKASAN reported a slab-use-after-free in lock_sock_nested() from\nrfcomm_connect_ind(), with the freeing stack going through\nrfcomm_sock_kill() and rfcomm_sock_release()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is reached by Bluetooth RFCOMM/L2CAP traffic from a nearby peer, so the attacker must be within Bluetooth radio range rather than merely local or internet-routable.\nAC:L - The race is between an inbound RFCOMM connect indication and listener close; an attacker with an unprivileged local RFCOMM listener plus a controlled adjacent Bluetooth peer can drive both sides repeatedly.\nPR:L - Creating, binding, listening on, and closing an RFCOMM stream socket has no CAP_NET_ADMIN gate, so only low local privileges are needed to control the listener side of the race.\nUI:N - No victim user action is required once the vulnerable listener/race setup exists; the attacker drives the RFCOMM connection attempts and close timing.\nS:U - The corruption is within the kernel networking/Bluetooth socket lifetime domain and does not cross a separate security authority such as a VM or IOMMU boundary.\nC:H - This is a slab use-after-free of a kernel struct sock, and the stale pointer is reused for locking, queueing, state checks, and callback-related state, making high confidentiality impact defensible.\nI:H - The stale listener socket can be operated on after free, including accept-queue manipulation and potential callback use, so kernel memory corruption/control-flow exploitation is defensible.\nA:H - KASAN reported a slab-use-after-free in this path, and even non-exploited triggering can crash or oops the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:36.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5ec76bdbeb80f75ad0be204371afffee0f8fac8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a07d741c077d4e34b16458241a94d29039386553"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f73f92f66251065a5f39b09a47cf05ea14d3107"
        },
        {
          "url": "https://git.kernel.org/stable/c/de31973ef00e5aa55496f84cf6a44bb157a34e02"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0e33e409715c617e2a20f46f99aa5403a14dfda"
        },
        {
          "url": "https://git.kernel.org/stable/c/8802413ce63175fb522a2bd609fb043a3550c720"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f4462d12133106460d7c046b95aad2491e3fddf"
        },
        {
          "url": "https://git.kernel.org/stable/c/43c441edacf953b39517a44f5e5e10a93618b226"
        }
      ],
      "title": "Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53256",
    "datePublished": "2026-06-25T08:39:46.591Z",
    "dateReserved": "2026-06-09T07:44:35.394Z",
    "dateUpdated": "2026-08-05T12:34:36.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.53.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-26T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s vfio/pci subsystem. During device shutdown, an improper order of operations in cleaning up Direct Memory Access Buffers (DMABUFs) before disabling the function creates a brief window. In this window, a device\u0027s Base Address Registers (BARs) could still be accessed via DMABUFs even after memory space enable (MSE) is cleared. This could potentially allow a different driver to access freed resources, leading to information disclosure or unauthorized resource access."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-826",
                "description": "Premature Release of Resource During Expected Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T12:04:54.439Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53322"
          },
          {
            "name": "RHBZ#2493709",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493709"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53322.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65334"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-26T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-26T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: vfio/pci: Clean up DMABUFs before disabling function",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, if PCI device passthrough is not required, the `vfio_pci` kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a file such as `/etc/modprobe.d/blacklist-vfio-pci.conf` with the content `blacklist vfio_pci`. A system reboot is required for this change to take effect. Disabling this module may impact functionality that relies on PCI device passthrough."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4f1000a30f67cf7d328059242776a858611d5ef9",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            },
            {
              "lessThan": "d97708701434ce72968e771976aaf9d3438fcafd",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Clean up DMABUFs before disabling function\n\nOn device shutdown, make vfio_pci_core_close_device() call\nvfio_pci_dma_buf_cleanup() before the function is disabled via\nvfio_pci_core_disable().  This ensures that all access via DMABUFs is\nrevoked before the function\u0027s BARs become inaccessible.\n\nThis fixes an issue where, if the function is disabled first, a tiny\nwindow exists in which the function\u0027s MSE is cleared and yet BARs\ncould still be accessed via the DMABUF.  The resources would also be\nfreed and up for grabs by a different driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local VFIO device file operations and ioctls, specifically exporting a VFIO PCI BAR DMA-BUF and then closing the VFIO device fd. It is not reachable by network packets or adjacent/physical-only input.\nAC:L - The attacker can set up the DMA-BUF/IOMMUFD mapping before triggering last-close, and the vulnerable cleanup ordering is deterministic. The P2P-capable VFIO/IOMMUFD environment is inherent to the affected feature rather than an uncontrollable exploitation condition.\nPR:L - The attacker needs local access to an assigned VFIO PCI device and IOMMUFD/VFIO file descriptors, but normal IOMMU-backed VFIO access does not require real root once the device node is delegated. This is privileged device access, but not necessarily administrator-level privilege.\nUI:N - No separate victim action is required after the attacker has the VFIO device fd. The attacker can export the DMA-BUF and trigger teardown by closing the fd.\nS:C - The bug can retain DMA-BUF access to PCI BAR MMIO after VFIO has disabled/released the function and potentially after resources are reassigned, crossing the VFIO/IOMMU device-ownership boundary. This is a DMA/IOMMU isolation bypass scenario.\nC:H - Stale peer-DMA access to MMIO BAR ranges can expose device registers or newly reclaimed MMIO resources outside the attacker\u0027s assigned VFIO device. In a severe reasonable deployment such as GPU, NIC, NVMe, or accelerator passthrough, this can disclose sensitive host, device, or guest data.\nI:H - The retained DMA-BUF mapping can allow unauthorized writes to MMIO registers or resources that should have been revoked, potentially programming device state or DMA behavior outside the attacker\u0027s ownership. That supports high integrity impact across the device isolation boundary.\nA:H - Accessing BAR MMIO after memory space is disabled or while resources are being reclaimed can crash or wedge devices and can trigger serious platform errors on sensitive systems. Repeated local triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:00.244Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4f1000a30f67cf7d328059242776a858611d5ef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d97708701434ce72968e771976aaf9d3438fcafd"
        }
      ],
      "title": "vfio/pci: Clean up DMABUFs before disabling function",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53322",
    "datePublished": "2026-06-26T19:41:13.245Z",
    "dateReserved": "2026-06-09T07:44:35.398Z",
    "dateUpdated": "2026-09-09T12:04:54.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a55618c0f4cead9e59c63f5ee030d393fd70d861",
              "status": "affected",
              "version": "c09b80be6ffc338634b2f5f8cfa12b6843410834",
              "versionType": "git"
            },
            {
              "lessThan": "a921957d39290143629eb38c4f74b9bef8035d0a",
              "status": "affected",
              "version": "c09b80be6ffc338634b2f5f8cfa12b6843410834",
              "versionType": "git"
            },
            {
              "lessThan": "d9019210c8c30d40eb20094274cc647e352f48f7",
              "status": "affected",
              "version": "c09b80be6ffc338634b2f5f8cfa12b6843410834",
              "versionType": "git"
            },
            {
              "lessThan": "380e67b1794a9a281a0cb592b4e62077fbd0c8ca",
              "status": "affected",
              "version": "c09b80be6ffc338634b2f5f8cfa12b6843410834",
              "versionType": "git"
            },
            {
              "lessThan": "bfea6091e0fffb270c20e74384b660910277eb6c",
              "status": "affected",
              "version": "c09b80be6ffc338634b2f5f8cfa12b6843410834",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix UAF in hci_le_create_cis_sync\n\nhci_le_create_cis_sync() dereferences conn-\u003econn_timeout after releasing\nboth rcu_read_lock() and hci_dev_lock(hdev).  The conn pointer was\nobtained from an RCU-protected iteration over hdev-\u003econn_hash.list and\nis not valid once these locks are dropped.  A concurrent disconnect can\nfree the hci_conn between the unlock and the dereference, causing a\nuse-after-free read.\n\nThe cancellation mechanism in hci_conn_del() cannot prevent this because\nhci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:\n\n    hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);\n\nWhile hci_conn_del() dequeues with data=conn:\n\n    hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);\n\nSince NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never\nmatches, and the pending work item is not cancelled.\n\nFix this by saving conn-\u003econn_timeout into a local variable while the\nlocks are still held, so the stale conn pointer is never dereferenced\nafter unlock.\n\nThis is the same class of bug as the one fixed by commit 035c25007c9e\n(\"Bluetooth: hci_sync: Fix UAF on le_read_features_complete\") which\naddressed the identical pattern in a different function.\n\nThis vulnerability was identified using 0sec.ai, an open-source\nautomated security auditing platform (https://github.com/0sec-labs)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel\u0027s own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn-\u003econn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:30.950Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861"
        },
        {
          "url": "https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6c"
        }
      ],
      "title": "Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63944",
    "datePublished": "2026-07-19T14:55:39.105Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-08-05T12:37:30.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c57ea90f203c8b8b41a474f19a09000d0f841436",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "119fb6f80c44dc1c65d604cf28e64c56bd9b6568",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "b04ec131325baf4ea4577d6c6e6b86cf092e3731",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "c318aa51830a3d2cc1229968fe521441c97356cd",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "1a6b803b00ccdd7666506adbe01ddae1c72d1ca9",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            },
            {
              "lessThan": "47f23a259517abbdb8032c057a1e8a6bf3734878",
              "status": "affected",
              "version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix UAF in iso_recv_frame\n\niso_recv_frame reads conn-\u003esk under iso_conn_lock but releases the lock\nbefore using sk, with no reference held. A concurrent iso_sock_kill()\ncan free sk in that window, causing use-after-free on sk-\u003esk_state and\nsock_queue_rcv_skb().\n\nFix by replacing the bare pointer read with iso_sock_hold(conn), which\ncalls sock_hold() while the spinlock is held, atomically elevating the\nrefcount before the lock drops. Add a drop_put label so sock_put() is\ncalled on all exit paths where the hold succeeded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk-\u003esk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:33.099Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436"
        },
        {
          "url": "https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731"
        },
        {
          "url": "https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9"
        },
        {
          "url": "https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878"
        }
      ],
      "title": "Bluetooth: ISO: fix UAF in iso_recv_frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63946",
    "datePublished": "2026-07-19T14:55:40.577Z",
    "dateReserved": "2026-07-19T07:54:57.023Z",
    "dateUpdated": "2026-08-05T12:37:33.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hidp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f08a90013e1e632b34321334e861fcefc056505",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cc3832b19f863e3677c5651f001a2e3795f39eb8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d313683d6ccdd8c01e0562270a2ae25b86d8461d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d7d6a81b8dd1a8d084a1b755db9406041d53adb5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6348dfed5b0f9c6074f14322332e97493d32fef0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b83dcacd2ec7fcc5a48be215f82d573759f87ec2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hidp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: fix missing length checks in hidp_input_report()\n\nhidp_input_report() reads keyboard and mouse payload data from an skb\nwithout first verifying that skb-\u003elen contains enough data.\n\nhidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching\nto hidp_input_report(). If a paired device sends a truncated packet,\nthe handler reads beyond the valid skb data, resulting in an\nout-of-bounds read of skb data. The OOB bytes may be interpreted as\nphantom key presses or spurious mouse movement.\n\nReplace the open-coded length tracking and pointer arithmetic with\nskb_pull_data() calls. skb_pull_data() returns NULL if the requested\nbytes are not present, eliminating the need for a manual size variable\nand the separate skb-\u003elen guard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when a connected Bluetooth HID peer sends malformed HIDP interrupt (or control DATA) frames over L2CAP ACL; packets traverse HCI \u2192 l2cap_recv_acldata() \u2192 l2cap_data_channel() \u2192 l2cap_sock_recv_cb() \u2192 HIDP session thread \u2192 hidp_recv_intr_frame()/hidp_process_data() \u2192 hidp_input_report(), which is an adjacent Bluetooth attack surface.\nAC:L - Exploitation only requires sending deliberately truncated HIDP input reports on an already-established HIDP/L2CAP session; the attacker fully controls packet length and can trigger the out-of-bounds read reliably on every malformed frame with no race or special memory layout.\nPR:N - The attacker is an external Bluetooth HID device sending L2CAP payloads and needs no Linux account, capability, or namespace privilege; CAP_NET_ADMIN is only required for bluetoothd to register the session, not for the malicious peer to deliver the crafted packets.\nUI:N - Once a HIDP session is active, exploitation is automatic from crafted Bluetooth traffic and requires no further victim action; pairing/connection is an attacker prerequisite, not user interaction at exploit time (consistent with prior Bluetooth HIDP CNA scoring such as CVE-2026-23462).\nS:U - Impact is confined to kernel HIDP/input handling and forged input events delivered within the same kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The vulnerable code performs out-of-bounds reads of up to eight keyboard or four mouse payload bytes beyond skb-\u003elen, and per CVSS kernel guidance any out-of-bounds read is rated High because adjacent skb tailroom may contain stale packet or kernel heap data observable through phantom key/mouse event side channels.\nI:H - Out-of-bounds bytes are interpreted as boot-protocol keyboard scancodes and mouse button/movement events, enabling phantom key presses and pointer injection into the system input layer; on laptops, kiosks, automotive consoles, and Android handsets this can forge arbitrary keystrokes/clicks against the active user session.\nA:H - Reading keyboard/mouse payload bytes past valid skb-\u003elen is undefined behavior on tightly allocated skbs with no tailroom and can fault the kernel; even when reads stay within tailroom, forged input can repeatedly disrupt session availability on shared/public Bluetooth keyboard deployments, and under the conservative scoring rule this is rated High when crash potential cannot be excluded."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:34.167Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6"
        }
      ],
      "title": "Bluetooth: HIDP: fix missing length checks in hidp_input_report()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63947",
    "datePublished": "2026-07-19T14:55:41.306Z",
    "dateReserved": "2026-07-19T07:54:57.023Z",
    "dateUpdated": "2026-08-05T12:37:34.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c8eaa91eb433c450426539290be4ffe282e9f00",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "ecfed1e0d8efecad6737a0d83e21d2fd021d8c48",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "e6833e737a51db1e5ea0401322acf5e22abd8be6",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "6319b38fe69f56ed95680ade485b957a53fff642",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "291eec1041c918c460dc9702e44edd17794b4a4b",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "41e29548b5e8b5e5fcf708786b3bea67cab107fa",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "d153b8898c0051eb8b6a083b35cbe304a5886bd5",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "41c2713b204e6cb6a94587bc6bf6935107df5479",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n\nIf dcid is received for an already-assigned destination CID the spec\nrequires that both channels to be discarded, but calling l2cap_chan_del\nmay invalidate the tmp cursor created by list_for_each_entry_safe and\nin fact it is the wrong procedure as the chan-\u003edcid may be assigned\npreviously it really needs to be disconnected.\n\nCalling l2cap_chan_clone directly may still lead to l2cap_chan_del so\ninstead schedule l2cap_chan_timeout with delay 0 to close the channel\nasynchronously."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame \u2192 l2cap_recv_acldata \u2192 l2cap_le_sig_channel \u2192 l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:46.003Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c8eaa91eb433c450426539290be4ffe282e9f00"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecfed1e0d8efecad6737a0d83e21d2fd021d8c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6833e737a51db1e5ea0401322acf5e22abd8be6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6319b38fe69f56ed95680ade485b957a53fff642"
        },
        {
          "url": "https://git.kernel.org/stable/c/291eec1041c918c460dc9702e44edd17794b4a4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/41e29548b5e8b5e5fcf708786b3bea67cab107fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/d153b8898c0051eb8b6a083b35cbe304a5886bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/41c2713b204e6cb6a94587bc6bf6935107df5479"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63975",
    "datePublished": "2026-07-19T14:56:00.662Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-08-05T12:37:46.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/keyring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c5d407ba3ff7f30561ff73ba1b07ed70c864edc",
              "status": "affected",
              "version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
              "versionType": "git"
            },
            {
              "lessThan": "cefa4265b11176c897a7d9e8e54d89e3701c5584",
              "status": "affected",
              "version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
              "versionType": "git"
            },
            {
              "lessThan": "5659e6923cb72f8e18e8b539109ab512455fe195",
              "status": "affected",
              "version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
              "versionType": "git"
            },
            {
              "lessThan": "50bb3435a5e627bfbdc52eb4536f49f88b3486b8",
              "status": "affected",
              "version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
              "versionType": "git"
            },
            {
              "lessThan": "66288dcadf80974436250e9f70ed848836b835b5",
              "status": "affected",
              "version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
              "versionType": "git"
            },
            {
              "lessThan": "43a1e3744548e6fd85873e6fb43e293eb4010694",
              "status": "affected",
              "version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/keyring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsecurity/keys: fix missed RCU read section on lookup\n\nNicholas Carlini reports that the keyring code calls assoc_array_find()\nin find_key_to_update() without holding the RCU read lock, while the\nassoc_array_gc() code really is designed around removing the node from\nthe tree and then freeing it after an RCU grace-period.\n\nThe regular key handling doesn\u0027t see this because holding the keyring\nsemaphore hides any lifetime issues, but the persistent key handling\nuses a different model.\n\nInstead of extending the keyring locking, just do the simple RCU locking\nthat the assoc_array was designed for."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker\u0027s own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:12.353Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc"
        },
        {
          "url": "https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584"
        },
        {
          "url": "https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195"
        },
        {
          "url": "https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694"
        }
      ],
      "title": "security/keys: fix missed RCU read section on lookup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64015",
    "datePublished": "2026-07-19T15:39:10.557Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:12.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mld/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e360e610a73f62432e986775023d5382773f045",
              "status": "affected",
              "version": "d1e879ec600f9b3bdd253167533959facfefb17b",
              "versionType": "git"
            },
            {
              "lessThan": "cbe1c8245e4469d1aa6e12e5d913611376d23788",
              "status": "affected",
              "version": "d1e879ec600f9b3bdd253167533959facfefb17b",
              "versionType": "git"
            },
            {
              "lessThan": "92cee08dc4f00e77fd1317e4343c5d458b0abab7",
              "status": "affected",
              "version": "d1e879ec600f9b3bdd253167533959facfefb17b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mld/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n\nWhen the TLC notification disables AMSDU for a TID, the MLD driver sets\nmax_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in\niwl_mld_tx_tso_segment() checks for zero but not for this sentinel,\nallowing it to reach the num_subframes calculation:\n\n  num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)\n                = (1 + 2) / (1534 + 2) = 0\n\nThis zero propagates to iwl_tx_tso_segment() which sets:\n\n  gso_size = num_subframes * mss = 0\n\nCalling skb_gso_segment() with gso_size=0 creates over 32000 tiny\nsegments from a single GSO skb. This floods the TX ring with ~1024\nmicro-frames (the rest are purged), creating a massive burst of TX\ncompletion events that can lead to memory corruption and a subsequent\nuse-after-free in TCP\u0027s retransmit queue (refcount underflow in\ntcp_shifted_skb, NULL deref in tcp_rack_detect_loss).\n\nThe MVM driver is immune because it checks mvmsta-\u003eamsdu_enabled before\nreaching the num_subframes calculation. The MLD driver has no equivalent\nbitmap check and relies solely on max_tid_amsdu_len, which does not\ncatch the sentinel value.\n\nFix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the\nexisting check and falling back to non-AMSDU TSO segmentation. Also add\na WARN_ON_ONCE guard after the num_subframes division as defense-in-depth\nto catch any future code paths that produce zero through a different\nmechanism."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer can trigger the vulnerable iwlwifi MLD TX/TSO path by inducing large outbound TCP traffic (responses, uploads, or sustained transfers) on a WiFi 7 Intel system; no adjacent WiFi frame injection or local syscall access is required to reach the bug.\nAC:L - An attacker controls the timing and volume of TCP traffic that produces GSO skbs, and TLC AMSDU-disable notifications are normal firmware rate-adaptation behavior that occurs during routine WiFi use; repeated attempts can reliably hit the sentinel state without conditions outside attacker influence.\nPR:N - Exploitation requires only the ability to generate or solicit network traffic on the victim\u0027s WiFi interface; no local account, CAP_NET_ADMIN, or root privileges are needed on the victim host.\nUI:N - No victim user action beyond normal automated network activity is required; a remote attacker can trigger the condition with crafted or high-volume TCP sessions alone.\nS:U - The resulting memory corruption and TCP retransmit-queue UAF occur within kernel/network-driver scope and do not cross a VM, container, or IOMMU security boundary.\nC:H - The fix commit documents memory corruption and a subsequent use-after-free in TCP\u0027s retransmit queue (refcount underflow in tcp_shifted_skb), which per kernel guidance enables arbitrary kernel memory read primitives.\nI:H - The same UAF and refcount corruption in the TCP retransmit path can be leveraged for arbitrary kernel writes and potential control-flow hijacking, not merely a bounded data change.\nA:H - The segmentation explosion floods the TX ring with ~1024 micro-frames and a burst of completion events, causing kernel instability including NULL dereference in tcp_rack_detect_loss and system crash/hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:31.759Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788"
        },
        {
          "url": "https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7"
        }
      ],
      "title": "wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64037",
    "datePublished": "2026-07-19T15:39:25.435Z",
    "dateReserved": "2026-07-19T07:54:57.028Z",
    "dateUpdated": "2026-08-05T12:38:31.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8443cd4497a4498c4b01058d76a92116244cb605",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            },
            {
              "lessThan": "702809dabdecca807bdd50cfdcc1c980feb2ba62",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting.  Otherwise, it\u0027s possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the VFIO_DEVICE_FEATURE ioctl on an open VFIO PCI device file descriptor; there is no network, adjacent-radio, or physical-bus entry point to this code.\nAC:L - An attacker with VFIO access can deterministically issue VFIO_DEVICE_FEATURE_DMA_BUF GET requests and probe BAR region indices; when a BAR failed reservation/mapping at enable time, export succeeds without races or attacker-uncontrollable timing.\nPR:L - Exploitation requires access to a VFIO-assigned PCI device (ioctl on /dev/vfio/* or /dev/vfio/devices/*), which is routinely delegated to unprivileged tenants in GPU passthrough/cloud and documented unprivileged VFIO deployments, not init-namespace root.\nUI:N - No victim interaction is required beyond the attacker already holding a VFIO device fd; triggering dma-buf export is a direct ioctl by the attacker process.\nS:C - Exporting an unreserved BAR bypasses VFIO\u2019s BAR reservation/iomap gate and exposes MMIO for peer-to-peer DMA via dma-buf/iommufd/RDMA importers, crossing the IOMMU/DMA security boundary that normal VFIO BAR read/write/mmap paths enforce.\nC:H - The exported dma-buf yields P2P DMA read access to MMIO physical addresses of BAR regions VFIO deliberately did not reserve, enabling disclosure of device registers and sensitive MMIO-backed state beyond the authorized VFIO mapping path.\nI:H - P2P DMA writes through the exported dma-buf can modify MMIO of an unreserved BAR and alter device behavior (including triggering further device DMA side effects), giving a high-integrity write primitive outside the intended VFIO access controls.\nA:H - Unauthorized MMIO access via P2P DMA to unreserved BAR resources can hang or crash device drivers, trigger platform instability during reset/FLR windows, and cause kernel oops/panics from conflicting host/device MMIO use."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:34.964Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605"
        },
        {
          "url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62"
        }
      ],
      "title": "vfio/pci: Check BAR resources before exporting a DMABUF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64042",
    "datePublished": "2026-07-19T15:39:28.604Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:34.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9baafc2fea096279e75480f93fd5942e8336b510",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "8dd6edbe26770df147136c3f2ac976c873b82650",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "97a8e89cdef36207a8776edc03d6931763a06ad0",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "8c795012d0e06b7740e40319b86ff8d2a435098d",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "aa16b2bc0f02709919e2435f531406531e5bcc69",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Add overflow check to remap_pfn_range during mmap\n\nThe call to remap_pfn_range in qaic_gem_object_mmap is susceptible to\n(re)mapping beyond the VMA if the BO is too large. This can cause use\nafter free issues when munmap() unmaps only the VMA region and not the\nadditional mappings. To prevent this, check the remaining size of the\nVMA before remapping and truncate the remapped length if sg-\u003elength is\ntoo large.\n\n[jhugo: fix braces from checkpatch --strict]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access via the QAIC accel device node (/dev/accel/accel*) through DRM ioctls and mmap syscalls; there is no network-facing attack surface.\nAC:L - An attacker fully controls BO allocation size, partial mmap length, and munmap timing, deterministically mapping PFNs beyond the VMA without races or external conditions.\nPR:L - No DRM master or root is required; any unprivileged local user with access to the accel device node (common on shared cloud AI inference hosts) can create a BO, partial-mmap it, and trigger the bug.\nUI:N - Exploitation requires only attacker-initiated ioctl and mmap operations on an open accel file descriptor, with no victim interaction.\nS:U - The UAF corrupts kernel page-table mappings within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries.\nC:H - The commit explicitly identifies a use-after-free of page structures left mapped past the VMA; UAF of kernel mappings enables arbitrary kernel memory read primitives.\nI:H - UAF on kernel page structures can be leveraged for arbitrary kernel memory writes and local privilege escalation through heap grooming and control of freed pages.\nA:H - Accessing stale PFN mappings after BO teardown causes kernel oops/panic; UAF reliably threatens system availability even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:42.519Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9baafc2fea096279e75480f93fd5942e8336b510"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dd6edbe26770df147136c3f2ac976c873b82650"
        },
        {
          "url": "https://git.kernel.org/stable/c/97a8e89cdef36207a8776edc03d6931763a06ad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c795012d0e06b7740e40319b86ff8d2a435098d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa16b2bc0f02709919e2435f531406531e5bcc69"
        }
      ],
      "title": "accel/qaic: Add overflow check to remap_pfn_range during mmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64051",
    "datePublished": "2026-07-19T15:39:34.608Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:42.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}