Action not permitted
Modal body text goes here.
Modal Title
Modal Body
RLSA-2026:68570 (CVE-2026-23172)
Vulnerability from osv_rocky – Published: 2026-09-19 12:04 – Updated: 2026-09-20 06:13 – Source website
VLAI
Summary
Important: kernel security, bug fix, and enhancement update
Details
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
-
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
-
kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
-
kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
-
kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
-
kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
-
kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
-
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
-
kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
-
kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
-
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
-
kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
-
kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
-
kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
-
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
-
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
-
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
-
kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
-
kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
-
kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)
-
kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
-
kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
-
kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
-
kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
-
kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
-
kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
-
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
-
kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
-
kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
-
kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)
-
kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
Bug Fix(es) and Enhancement(s):
-
gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)
-
The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky Linux-252544)
-
gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)
-
[Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255217)
-
[usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:Rocky Linux-256733)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
8.8 (High)
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:9",
"name": "kernel",
"purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "BaseOS"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:5.14.0-687.49.1.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"database_specific": {
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:68570"
},
"details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)\n\n* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)\n\n* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)\n\n* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)\n\n* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)\n\n* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n\n* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)\n\n* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n\n* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)\n\n* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)\n\n* kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)\n\n* kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)\n\n* kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)\n\n* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)\n\n* kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)\n\n* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)\n\n* kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)\n\n* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\n* kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)\n\n* kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)\n\n* kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)\n\n* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)\n\nBug Fix(es) and Enhancement(s):\n\n* gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)\n\n* The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky Linux-252544)\n\n* gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)\n\n* [Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255217)\n\n* [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:Rocky Linux-256733)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:68570",
"modified": "2026-09-20T06:13:38.917955Z",
"published": "2026-09-19T12:04:58.550496Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:68570"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439924"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482098"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482127"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482550"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482618"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492436"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492742"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502295"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502347"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502438"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502575"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502580"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502596"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511448"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513165"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513171"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513271"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513286"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516490"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516599"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516679"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516684"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:68570"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: kernel security, bug fix, and enhancement update",
"upstream": [
"CVE-2026-23172",
"CVE-2026-31663",
"CVE-2026-45910",
"CVE-2026-46043",
"CVE-2026-46114",
"CVE-2026-46133",
"CVE-2026-52971",
"CVE-2026-53176",
"CVE-2026-53192",
"CVE-2026-53193",
"CVE-2026-53196",
"CVE-2026-53239",
"CVE-2026-63869",
"CVE-2026-63913",
"CVE-2026-63917",
"CVE-2026-63919",
"CVE-2026-63921",
"CVE-2026-64029",
"CVE-2026-64174",
"CVE-2026-64175",
"CVE-2026-64176",
"CVE-2026-64582",
"CVE-2026-68128",
"CVE-2026-68159",
"CVE-2026-68200",
"CVE-2026-68363",
"CVE-2026-68426",
"CVE-2026-72003",
"CVE-2026-72102",
"CVE-2026-72243",
"CVE-2026-72298"
]
}
CVE-2026-53196 (GCVE-0-2026-53196)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-18 12:04
VLAI
EPSS
VEX
Title
USB: serial: io_ti: fix heap overflow in get_manuf_info()
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: io_ti: fix heap overflow in get_manuf_info()
get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the
device I2C EEPROM into a buffer allocated with kmalloc_obj(), which
is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.
The Size field comes from the device and is only validated (in
check_i2c_image()) to make sure the descriptor fits within
TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.
A malicious USB device can therefore set Size to any value up to 16377,
causing a heap overflow of up to 16367 bytes when plugged into a host
running this driver.
valid_csum() is called after read_rom() and also iterates
buffer[0..Size-1], compounding the out-of-bounds access.
Fix by rejecting descriptors with unexpected length before calling
read_rom().
[ johan: amend commit message; also check for short descriptors ]
Severity
6.8 (Medium)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
21 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/e168db91442b94e64… | |
| https://git.kernel.org/stable/c/561edb021486e6723… | |
| https://git.kernel.org/stable/c/cfd634f6dfd40c49a… | |
| https://git.kernel.org/stable/c/d92f17af7097d10bd… | |
| https://git.kernel.org/stable/c/b849f30d1a9e66aae… | |
| https://git.kernel.org/stable/c/f96cf7bf9fbf15d7f… | |
| https://git.kernel.org/stable/c/d214d2341d4f9f447… | |
| https://git.kernel.org/stable/c/183c1076eca43bbb3… | |
| https://access.redhat.com/security/cve/CVE-2026-53196 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492750 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:67114 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:61887 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67723 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:65712 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:65708 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:68570 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:65710 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:65711 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:65709 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:67721 | vendor-advisoryx_refsource_REDHAT |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e168db91442b94e64fa82a7dd297983d48ea5cc0
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 561edb021486e6723d841926aa4b48097da06190 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cfd634f6dfd40c49a84f9bddc2867a80e2e2623a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d92f17af7097d10bdeddf26f66f34b354104b277 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b849f30d1a9e66aae6b715aaef66e427390cb081 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d214d2341d4f9f447e36a7d012cdf6a6631a55f1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 183c1076eca43bbb3e7bdf597456f91d81c73e74 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:6.12.0-211.50.1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:6.12.0-55.104.1.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:4.18.0-305.206.1.el8_4 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.4 |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:4.18.0-305.206.1.el8_4 , < *
(rpm)
cpe:/o:redhat:rhel_eus_long_life:8.4 |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:4.18.0-372.213.1.el8_6 , < *
(rpm)
cpe:/o:redhat:rhel_aus:8.6 |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On |
Unaffected:
0:4.18.0-372.213.1.el8_6 , < *
(rpm)
cpe:/o:redhat:rhel_eus_long_life:8.6 |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:4.18.0-477.166.1.el8_8 , < *
(rpm)
cpe:/o:redhat:rhel_tus:8.8 |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:4.18.0-477.166.1.el8_8 , < *
(rpm)
cpe:/o:redhat:rhel_e4s:8.8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:5.14.0-687.49.1.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-284.191.1.el9_2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2 |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-284.191.1.rt14.476.el9_2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2::nfv |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions |
Unaffected:
0:5.14.0-427.149.1.el9_4 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.4 |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:5.14.0-570.140.1.el9_6 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.50.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.104.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.206.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.206.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.213.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.213.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.166.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.166.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.49.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.191.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.191.1.rt14.476.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.149.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.140.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device\u0027s I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T12:04:49.281Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53196"
},
{
"name": "RHBZ#2492750",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53196.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67114"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:61887"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67723"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65708"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68570"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65710"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65711"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65709"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67721"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:67114: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:67723: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:65708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:68570: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:65710: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:65711: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:65709: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:67721: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/io_ti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e168db91442b94e64fa82a7dd297983d48ea5cc0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "561edb021486e6723d841926aa4b48097da06190",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cfd634f6dfd40c49a84f9bddc2867a80e2e2623a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d92f17af7097d10bdeddf26f66f34b354104b277",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b849f30d1a9e66aae6b715aaef66e427390cb081",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d214d2341d4f9f447e36a7d012cdf6a6631a55f1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "183c1076eca43bbb3e7bdf597456f91d81c73e74",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/io_ti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in get_manuf_info()\n\nget_manuf_info() reads le16_to_cpu(rom_desc-\u003eSize) bytes from the\ndevice I2C EEPROM into a buffer allocated with kmalloc_obj(), which\nis sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.\n\nThe Size field comes from the device and is only validated (in\ncheck_i2c_image()) to make sure the descriptor fits within\nTI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.\nA malicious USB device can therefore set Size to any value up to 16377,\ncausing a heap overflow of up to 16367 bytes when plugged into a host\nrunning this driver.\n\nvalid_csum() is called after read_rom() and also iterates\nbuffer[0..Size-1], compounding the out-of-bounds access.\n\nFix by rejecting descriptors with unexpected length before calling\nread_rom().\n\n[ johan: amend commit message; also check for short descriptors ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:06.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0"
},
{
"url": "https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190"
},
{
"url": "https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a"
},
{
"url": "https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277"
},
{
"url": "https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081"
},
{
"url": "https://git.kernel.org/stable/c/f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea"
},
{
"url": "https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1"
},
{
"url": "https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74"
}
],
"title": "USB: serial: io_ti: fix heap overflow in get_manuf_info()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53196",
"datePublished": "2026-06-25T08:39:06.330Z",
"dateReserved": "2026-06-09T07:44:35.391Z",
"dateUpdated": "2026-09-18T12:04:49.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53239 (GCVE-0-2026-53239)
Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-08 08:50
VLAI
EPSS
VEX
Title
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Fix the race by pruning the bin while still holding xfrm_policy_lock,
before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since
the lock is already held. The wrapper xfrm_policy_inexact_prune_bin()
becomes unused and is removed.
Race:
CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)
========================== ==========================
xfrm_policy_bysel_ctx():
spin_lock_bh(xfrm_policy_lock)
bin = xfrm_policy_inexact_lookup()
__xfrm_policy_unlink(pol)
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_kill(ret)
// wide window, lock not held
xfrm_hash_rebuild():
spin_lock_bh(xfrm_policy_lock)
__xfrm_policy_inexact_flush():
kfree_rcu(bin) // bin freed
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_inexact_prune_bin(bin)
// UAF: bin is freed
Severity
7.8 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/8fc536e9f6856230f… | |
| https://git.kernel.org/stable/c/c4c1ea36d83bf3c45… | |
| https://git.kernel.org/stable/c/25c8c7fb3b0b9668c… | |
| https://git.kernel.org/stable/c/42827d03f8009a6a2… | |
| https://git.kernel.org/stable/c/88697cf980222d590… | |
| https://git.kernel.org/stable/c/b5316e2b8614a87d8… | |
| https://git.kernel.org/stable/c/ec82ea4eb220164d8… | |
| https://git.kernel.org/stable/c/7f2d76c9c03257c07… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6be3b0db6db82cf056a72cc18042048edd27f8ee , < 8fc536e9f6856230f19c7d13e71af064b6a77b22
(git)
Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < c4c1ea36d83bf3c4569468ca5b8b614fda1bf821 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 25c8c7fb3b0b9668c7d05e209f58c158d2b020c7 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 42827d03f8009a6a218bacab153e21f39d6a121c (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 88697cf980222d5906a37bf47662dac0732e2a0f (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < b5316e2b8614a87d8736941972441cb47bfd4491 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < ec82ea4eb220164d854f8734ca5a35e23e577b94 (git) Affected: 6be3b0db6db82cf056a72cc18042048edd27f8ee , < 7f2d76c9c03257c0782afef9d95321fa04096f60 (git) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:50:08.903Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8fc536e9f6856230f19c7d13e71af064b6a77b22",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "c4c1ea36d83bf3c4569468ca5b8b614fda1bf821",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "25c8c7fb3b0b9668c7d05e209f58c158d2b020c7",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "42827d03f8009a6a218bacab153e21f39d6a121c",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "88697cf980222d5906a37bf47662dac0732e2a0f",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "b5316e2b8614a87d8736941972441cb47bfd4491",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "ec82ea4eb220164d854f8734ca5a35e23e577b94",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "7f2d76c9c03257c0782afef9d95321fa04096f60",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)\n ========================== ==========================\n xfrm_policy_bysel_ctx():\n spin_lock_bh(xfrm_policy_lock)\n bin = xfrm_policy_inexact_lookup()\n __xfrm_policy_unlink(pol)\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_kill(ret)\n // wide window, lock not held\n xfrm_hash_rebuild():\n spin_lock_bh(xfrm_policy_lock)\n __xfrm_policy_inexact_flush():\n kfree_rcu(bin) // bin freed\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_inexact_prune_bin(bin)\n // UAF: bin is freed"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through NETLINK_XFRM messages such as XFRM_MSG_DELPOLICY and XFRM_MSG_NEWSPDINFO, which require local netlink access rather than remote packet delivery.\nAC:L - The attacker controls both sides of the race by creating/deleting an inexact XFRM policy while concurrently triggering SPD hash rebuilds, with no required external victim state.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN, but the check is namespace-scoped via netlink_net_capable() and is reachable with CAP_NET_ADMIN in a user-created network namespace on systems allowing user namespaces.\nUI:N - No victim action is required; the attacker can issue the needed netlink messages directly.\nS:U - The vulnerability corrupts kernel networking/XFRM state within the same kernel security authority and does not cross a hypervisor, IOMMU, or separate trust boundary.\nC:H - This is a use-after-free of an XFRM inexact policy bin, and the stale freed object can be dereferenced after attacker-controlled heap reuse, making high confidentiality impact defensible.\nI:H - The stale bin is not only read but also passed into pruning logic that writes list/rhashtable/seqcount state, so exploitation can plausibly yield memory corruption and control-flow or data integrity compromise.\nA:H - The UAF can trigger kernel memory corruption, KASAN splats, oopses, or panics, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:25.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22"
},
{
"url": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"
},
{
"url": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"
},
{
"url": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c"
},
{
"url": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f"
},
{
"url": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491"
},
{
"url": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94"
},
{
"url": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60"
}
],
"title": "xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53239",
"datePublished": "2026-06-25T08:39:35.149Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-09-08T08:50:08.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63869 (GCVE-0-2026-63869)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:18 – Updated: 2026-08-05 12:36
VLAI
EPSS
VEX
Title
wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
When parsing the radiotap header of an injected frame,
ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value
directly as a shift count:
info->control.antennas |= BIT(*iterator.this_arg);
*iterator.this_arg is an 8-bit value taken straight from the frame
supplied by userspace, so BIT() can be asked to shift by up to 255. That
is undefined behaviour on the unsigned long and is reported by UBSAN:
UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30
shift exponent 235 is too large for 64-bit type 'unsigned long'
Call Trace:
ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174
ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451
...
packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109
info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna
indices 0 and 1 can ever be represented. Ignore any larger value instead
of shifting out of bounds.
Severity
7.6 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ef246a1480cc484cd2aeda75737cb0848616ddf3 , < f6d3dc8e8492bf8435e0b23c99472af7bafd6b44
(git)
Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < 9b40c59bab08f2a99abf969cc0bb92fa49de004b (git) Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < 033ce021a220913ac02416fcb5ac883a9ff8b6c7 (git) Affected: ef246a1480cc484cd2aeda75737cb0848616ddf3 , < 6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663 (git) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f6d3dc8e8492bf8435e0b23c99472af7bafd6b44",
"status": "affected",
"version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
"versionType": "git"
},
{
"lessThan": "9b40c59bab08f2a99abf969cc0bb92fa49de004b",
"status": "affected",
"version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
"versionType": "git"
},
{
"lessThan": "033ce021a220913ac02416fcb5ac883a9ff8b6c7",
"status": "affected",
"version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
"versionType": "git"
},
{
"lessThan": "6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663",
"status": "affected",
"version": "ef246a1480cc484cd2aeda75737cb0848616ddf3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap\n\nWhen parsing the radiotap header of an injected frame,\nieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value\ndirectly as a shift count:\n\n\tinfo-\u003econtrol.antennas |= BIT(*iterator.this_arg);\n\n*iterator.this_arg is an 8-bit value taken straight from the frame\nsupplied by userspace, so BIT() can be asked to shift by up to 255. That\nis undefined behaviour on the unsigned long and is reported by UBSAN:\n\n UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30\n shift exponent 235 is too large for 64-bit type \u0027unsigned long\u0027\n Call Trace:\n ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174\n ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451\n ...\n packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109\n\ninfo-\u003econtrol.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna\nindices 0 and 1 can ever be represented. Ignore any larger value instead\nof shifting out of bounds."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in mac80211 WiFi frame injection (radiotap parsing on monitor-mode TX), reachable only on systems with WiFi hardware in monitor mode; per kernel CNA guidance, WiFi frame injection maps to Adjacent.\nAC:L - The attacker fully controls the injected radiotap header via sendmsg() on an AF_PACKET socket and can reliably set IEEE80211_RADIOTAP_ANTENNA to any 8-bit value to trigger the out-of-bounds shift.\nPR:L - Reaching the path requires CAP_NET_RAW to open AF_PACKET sockets and CAP_NET_ADMIN to create a monitor interface via nl80211; both capabilities are obtainable by an unprivileged user through user namespaces (unshare -Urn).\nUI:N - Exploitation requires no action from a victim user; the attacker injects crafted frames through their own local socket.\nS:U - Impact is confined to kernel memory and WiFi TX state within the same security authority; this is not a VM escape or cross-boundary sandbox breakout.\nC:H - The unchecked antenna index causes shift-out-of-bounds undefined behavior while parsing attacker-controlled data into the skb control block (ieee80211_tx_info), constituting kernel memory corruption that could be leveraged for information disclosure.\nI:H - The undefined-behavior shift result is ORed into a bitfield in skb-\u003ecb, corrupting injection control metadata in kernel memory; such corruption in the TX path is potentially exploitable for further memory writes or control-flow manipulation.\nA:L - The primary demonstrated impact is a UBSAN shift-out-of-bounds report rather than a demonstrated kernel panic, but undefined behavior during packet processing can still cause degraded or unpredictable system behavior."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:44.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f6d3dc8e8492bf8435e0b23c99472af7bafd6b44"
},
{
"url": "https://git.kernel.org/stable/c/9b40c59bab08f2a99abf969cc0bb92fa49de004b"
},
{
"url": "https://git.kernel.org/stable/c/033ce021a220913ac02416fcb5ac883a9ff8b6c7"
},
{
"url": "https://git.kernel.org/stable/c/6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663"
}
],
"title": "wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63869",
"datePublished": "2026-07-19T14:18:38.426Z",
"dateReserved": "2026-07-19T07:54:57.017Z",
"dateUpdated": "2026-08-05T12:36:44.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63913 (GCVE-0-2026-63913)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
An unintended behavior in the TCP conntrack state machine allows a
connection to be forced into the CLOSE state using an RST packet with an
invalid sequence number.
Specifically, after a SYN packet is observed, an RST with an invalid SEQ
can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of
whether the RST corresponds to the expected reply direction. The relevant
code path assumes the RST is a response to an outgoing SYN, but does not
validate packet direction or ensure that a matching SYN was actually sent
in the opposite direction.
As a result, a crafted packet sequence consisting of a SYN followed by an
invalid-sequence RST can prematurely terminate an active NAT entry. This
makes connection teardown easier than intended.
So, tighten the state transition logic to ensure that RST-triggered
CLOSE transitions only occur when the RST is a valid response to a
previously observed SYN in the correct direction.
Severity
8.2 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/2006979a15af5404b… | |
| https://git.kernel.org/stable/c/6476c17d536dbd321… | |
| https://git.kernel.org/stable/c/f5547bebc416d56f5… | |
| https://git.kernel.org/stable/c/2bb6d82b586ea5a4c… | |
| https://git.kernel.org/stable/c/f206def4e86d810f9… | |
| https://git.kernel.org/stable/c/b98ab51c45c5608a1… | |
| https://git.kernel.org/stable/c/d67c6adee8d1b6533… | |
| https://git.kernel.org/stable/c/bed6e04be8e6b9133… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 2006979a15af5404bf932a325357683c0bac1656
(git)
Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 6476c17d536dbd321c073242e762ddb2713a1238 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < f5547bebc416d56f56fb5b86dc20aabfa42165a0 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < f206def4e86d810f927ba1d8e322ea72b29bce58 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < b98ab51c45c5608a1c19ce7fd17a3032469bb83f (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < d67c6adee8d1b65330d0174c4c367faba14e80a8 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a (git) |
|
| Linux | Linux |
Affected:
2.6.15
Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_proto_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2006979a15af5404bf932a325357683c0bac1656",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "6476c17d536dbd321c073242e762ddb2713a1238",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
},
{
"lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a",
"status": "affected",
"version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_proto_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.\nAC:L - The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.\nPR:N - Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.\nUI:N - No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.\nS:U - Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.\nC:N - This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.\nI:L - The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.\nA:H - Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:07.250Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"
},
{
"url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"
},
{
"url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"
},
{
"url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"
},
{
"url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"
},
{
"url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"
},
{
"url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"
},
{
"url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"
}
],
"title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63913",
"datePublished": "2026-07-19T14:55:17.917Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:07.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63917 (GCVE-0-2026-63917)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_changelink().
ip netns add ns1
ip netns add ns2
ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7
ip -n ns1 link set vti6_test netns ns2
ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9
ip netns del ns2
ip netns del ns1
[ 132.495484] ------------[ cut here ]------------
[ 132.497609] kernel BUG at net/core/dev.c:12376!
Commit 61220ab34948 ("vti6: Enable namespace changing") dropped
NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then
move through IFLA_NET_NS_FD. After the move dev_net(dev) points
at the new netns while t->net stays at the creation netns.
vti6_changelink() and vti6_update() still use dev_net(dev) and
dev_net(t->dev). They unlink from one per netns hash and relink
into another. The creation netns is left with a stale entry.
cleanup_net() of that netns later walks freed memory.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/0cdce7618464f7fb0… | |
| https://git.kernel.org/stable/c/f5c68875e25f331e4… | |
| https://git.kernel.org/stable/c/d9c5eecdb3c740e65… | |
| https://git.kernel.org/stable/c/f1e89a943ee574d0f… | |
| https://git.kernel.org/stable/c/225b467e3b631f38b… | |
| https://git.kernel.org/stable/c/fc32be9ac2788524c… | |
| https://git.kernel.org/stable/c/ee1778ba0f5cb53be… | |
| https://git.kernel.org/stable/c/11b326fb0a374f465… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
61220ab349485d911083d0b7990ccd3db6c63297 , < 0cdce7618464f7fb06f461e8f4ad575cb1d570f4
(git)
Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < f5c68875e25f331e497ddfbe81e2d8163a87f136 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < d9c5eecdb3c740e65038651db7c686b10d76d1bc (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < f1e89a943ee574d0f2f16246eb3f2d7330fdeb03 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 225b467e3b631f38be22e4b38062a1fed02fdd21 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < fc32be9ac2788524c6b24efd681cce7a6e731a92 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < ee1778ba0f5cb53be771f97017d01eb356c797bf (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe (git) |
|
| Linux | Linux |
Affected:
3.15
Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cdce7618464f7fb06f461e8f4ad575cb1d570f4",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f5c68875e25f331e497ddfbe81e2d8163a87f136",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d9c5eecdb3c740e65038651db7c686b10d76d1bc",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f1e89a943ee574d0f2f16246eb3f2d7330fdeb03",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "225b467e3b631f38be22e4b38062a1fed02fdd21",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "fc32be9ac2788524c6b24efd681cce7a6e731a92",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "ee1778ba0f5cb53be771f97017d01eb356c797bf",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[ 132.495484] ------------[ cut here ]------------\n[ 132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t-\u003enet stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t-\u003edev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker\u0027s security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:11.588Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4"
},
{
"url": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136"
},
{
"url": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc"
},
{
"url": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03"
},
{
"url": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21"
},
{
"url": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92"
},
{
"url": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf"
},
{
"url": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe"
}
],
"title": "ip6: vti: Use ip6_tnl.net in vti6_changelink().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63917",
"datePublished": "2026-07-19T14:55:20.703Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:11.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63919 (GCVE-0-2026-63919)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
xfrm: input: hold netns during deferred transport reinjection
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: input: hold netns during deferred transport reinjection
Transport-mode reinjection stores a struct net pointer in skb->cb and
uses it later from xfrm_trans_reinject(). That pointer must stay valid
until the deferred callback runs.
Take a netns reference when queueing deferred reinjection work and drop
it after the callback completes. Use maybe_get_net() so the queueing
path does not revive a namespace that is already being torn down.
This keeps the existing workqueue design and fixes the netns lifetime
handling in one place for all users of xfrm_trans_queue_net().
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/7ee59eda8820b758e… | |
| https://git.kernel.org/stable/c/2df7059a18afb7d3a… | |
| https://git.kernel.org/stable/c/8dfabcba6a943a7a0… | |
| https://git.kernel.org/stable/c/48ce101cd630d6745… | |
| https://git.kernel.org/stable/c/55ddfc41451f01c58… | |
| https://git.kernel.org/stable/c/9f7ebb45a83afc321… | |
| https://git.kernel.org/stable/c/9f67a36e91bb50d35… | |
| https://git.kernel.org/stable/c/c16f74dc1d75d0e2e… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7b3801927e52f8621de311277f7fc727635019e7 , < 7ee59eda8820b758ed29e1cd3222359c7b97302c
(git)
Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 2df7059a18afb7d3aee6c36cad5d371c198111d4 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 8dfabcba6a943a7a02ebe1e1637c361ba96acbaa (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 48ce101cd630d6745b6923b5bad8358bc4c119da (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 55ddfc41451f01c588089cd74957a05311b6f202 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 9f7ebb45a83afc3216e855e57d51bb4bc9b5232e (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < 9f67a36e91bb50d358760f381f233913fe5c09f8 (git) Affected: 7b3801927e52f8621de311277f7fc727635019e7 , < c16f74dc1d75d0e2e7670076d5375deda110ebeb (git) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ee59eda8820b758ed29e1cd3222359c7b97302c",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "2df7059a18afb7d3aee6c36cad5d371c198111d4",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "8dfabcba6a943a7a02ebe1e1637c361ba96acbaa",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "48ce101cd630d6745b6923b5bad8358bc4c119da",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "55ddfc41451f01c588089cd74957a05311b6f202",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "9f7ebb45a83afc3216e855e57d51bb4bc9b5232e",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "9f67a36e91bb50d358760f381f233913fe5c09f8",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "c16f74dc1d75d0e2e7670076d5375deda110ebeb",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: input: hold netns during deferred transport reinjection\n\nTransport-mode reinjection stores a struct net pointer in skb-\u003ecb and\nuses it later from xfrm_trans_reinject(). That pointer must stay valid\nuntil the deferred callback runs.\n\nTake a netns reference when queueing deferred reinjection work and drop\nit after the callback completes. Use maybe_get_net() so the queueing\npath does not revive a namespace that is already being torn down.\n\nThis keeps the existing workqueue design and fixes the netns lifetime\nhandling in one place for all users of xfrm_trans_queue_net()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:13.727Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c"
},
{
"url": "https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4"
},
{
"url": "https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa"
},
{
"url": "https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da"
},
{
"url": "https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202"
},
{
"url": "https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e"
},
{
"url": "https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8"
},
{
"url": "https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb"
}
],
"title": "xfrm: input: hold netns during deferred transport reinjection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63919",
"datePublished": "2026-07-19T14:55:22.121Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:13.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63921 (GCVE-0-2026-63921)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
EPSS
VEX
Title
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
After patch 1/2 in this series, vti6_update() unlinks and relinks
the tunnel through t->net. vti6_siocdevprivate() still uses
dev_net(dev) for the collision lookup. For a tunnel moved through
IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.
SIOCCHGTUNNEL on a migrated tunnel then runs:
net = dev_net(dev) /* migrated netns */
t = vti6_locate(net, &p1, false) /* misses target in t->net */
...
t = netdev_priv(dev)
vti6_update(t, &p1, false) /* mutates t->net's hash */
A caller in the migrated netns picks params that match a tunnel
in the creation netns. The lookup in dev_net(dev) finds nothing.
vti6_update() prepends the migrated tunnel at the head of the
creation netns hash bucket for those params. Later lookups in
the creation netns resolve to the migrated device. xfrm receive
delivers the matched packets through a device the caller controls.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Switch the SIOCCHGTUNNEL path on a non fallback device to use
t->net for the lookup. The lookup now matches the netns
vti6_update() operates on.
Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before
the lookup. The check at the top of the case is against
dev_net(dev)->user_ns, which after migration is the attacker's
netns. A caller there can pick params absent from self->net,
the lookup returns NULL, t becomes self, and vti6_update()
inserts the device into the creation netns hash. The new check
requires CAP_NET_ADMIN in the creation netns user_ns too.
SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep
dev_net(dev), which equals init_net there.
Severity
8.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/94ff740a7f9ef5c01… | |
| https://git.kernel.org/stable/c/df42ac708acc3399b… | |
| https://git.kernel.org/stable/c/44d2ff7d2178503b9… | |
| https://git.kernel.org/stable/c/1acfb7d9c6fc7e209… | |
| https://git.kernel.org/stable/c/d2236348414bdd655… | |
| https://git.kernel.org/stable/c/853f6ea482dfcd340… | |
| https://git.kernel.org/stable/c/596f6354c96a891e5… | |
| https://git.kernel.org/stable/c/8b484efd5cb4eeef9… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
61220ab349485d911083d0b7990ccd3db6c63297 , < 94ff740a7f9ef5c010784a325dca00cbf228f941
(git)
Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < df42ac708acc3399bbb6dc5ca16e0540adda7bbf (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 44d2ff7d2178503b93151140a45dfa2ad49c9906 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 1acfb7d9c6fc7e209ed7789392697e97e03edd33 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < d2236348414bdd6558385f35aa7fdc9bf5634011 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 853f6ea482dfcd3404bbef458ab4d68364eed838 (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 596f6354c96a891e58c04a09cbfb7b0d1ec00dab (git) Affected: 61220ab349485d911083d0b7990ccd3db6c63297 , < 8b484efd5cb4eeef9021a661e198edc5349dacf6 (git) |
|
| Linux | Linux |
Affected:
3.15
Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94ff740a7f9ef5c010784a325dca00cbf228f941",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "df42ac708acc3399bbb6dc5ca16e0540adda7bbf",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "44d2ff7d2178503b93151140a45dfa2ad49c9906",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "1acfb7d9c6fc7e209ed7789392697e97e03edd33",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d2236348414bdd6558385f35aa7fdc9bf5634011",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "853f6ea482dfcd3404bbef458ab4d68364eed838",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "596f6354c96a891e58c04a09cbfb7b0d1ec00dab",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "8b484efd5cb4eeef9021a661e198edc5349dacf6",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t-\u003enet. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t-\u003enet.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n net = dev_net(dev) /* migrated netns */\n t = vti6_locate(net, \u0026p1, false) /* misses target in t-\u003enet */\n ...\n t = netdev_priv(dev)\n vti6_update(t, \u0026p1, false) /* mutates t-\u003enet\u0027s hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt-\u003enet for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self-\u003enet-\u003euser_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)-\u003euser_ns, which after migration is the attacker\u0027s\nnetns. A caller there can pick params absent from self-\u003enet,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace\u0027s user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant\u0027s network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker\u0027s own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant\u0027s network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim\u0027s IPsec connectivity."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:15.900Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941"
},
{
"url": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf"
},
{
"url": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906"
},
{
"url": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33"
},
{
"url": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011"
},
{
"url": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838"
},
{
"url": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab"
},
{
"url": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6"
}
],
"title": "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63921",
"datePublished": "2026-07-19T14:55:23.539Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-08-05T12:37:15.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64029 (GCVE-0-2026-64029)
Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
EPSS
VEX
Title
ALSA: seq: Serialize UMP output teardown with event_input
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Serialize UMP output teardown with event_input
seq_ump_process_event() borrows client->out_rfile.output without
synchronizing with the first-open and last-close transition in
seq_ump_client_open() and seq_ump_client_close().
The last output unuse can therefore drop opened[STR_OUT] to zero and
release the rawmidi file while an in-flight event_input callback is still
inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream
runtime exposed to teardown before the write path has taken its own
buffer reference.
Add a per-client rwlock for the event_input-visible output file. Publish
a newly opened output file under the write side, and hold the read side
from the output lookup through snd_rawmidi_kernel_write(). The last
output close copies and clears the visible output file under the write
side, then drops the lock and releases the saved rawmidi file. Use
IRQ-safe rwlock guards because event_input can also be reached from
atomic sequencer delivery.
The buggy scenario involves two paths, with each column showing the
order within that path:
path A label: event_input path path B label: last unuse path
1. seq_ump_process_event() reads 1. seq_ump_client_close()
client->out_rfile.output. drops opened[STR_OUT] to zero.
2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release()
has not yet pinned runtime. closes the output file.
3. The writer continues using 3. close_substream() frees
the borrowed substream. substream->runtime.
This keeps the output substream and runtime alive for the full
event_input write while keeping rawmidi release outside the rwlock.
KASAN reproduced this as a slab-use-after-free in
snd_rawmidi_kernel_write1(), with allocation through
seq_ump_use()/snd_seq_port_connect() and free through
seq_ump_unuse()/snd_seq_port_disconnect().
Validation reproduced this kernel report:
KASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400
RIP: 0033:0x7f5528af837f
Read of size 8
Call trace:
dump_stack_lvl+0x73/0xb0 (?:?)
print_report+0xd1/0x650 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
__virt_addr_valid+0x1a7/0x340 (?:?)
kasan_complete_mode_report_info+0x64/0x200 (?:?)
kasan_report+0xf7/0x130 (?:?)
snd_rawmidi_kernel_write1+0x9d/0x400 (?:?)
__asan_load8+0x82/0xb0 (?:?)
update_stack_state+0x1ef/0x2d0 (?:?)
snd_rawmidi_kernel_write+0x1a/0x20 (?:?)
seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82)
__snd_seq_deliver_single_event+0x8a/0xe0 (?:?)
snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?)
lock_acquire+0x14e/0x2e0 (?:?)
find_held_lock+0x31/0x90 (?:?)
snd_seq_port_use_ptr+0xa6/0xe0 (?:?)
__kasan_check_write+0x18/0x20 (?:?)
do_raw_read_unlock+0x32/0xa0 (?:?)
_raw_read_unlock+0x26/0x50 (?:?)
snd_seq_deliver_single_event+0x45c/0x4b0 (?:?)
snd_seq_deliver_event+0x10d/0x1b0 (?:?)
snd_seq_client_enqueue_event+0x192/0x240 (?:?)
snd_seq_write+0x2cd/0x450 (?:?)
apparmor_file_permission+0x20/0x30 (?:?)
security_file_permission+0x51/0x60 (?:?)
vfs_write+0x1ce/0x850 (?:?)
__fget_files+0x12b/0x220 (?:?)
lock_release+0xc8/0x2a0 (?:?)
__rcu_read_unlock+0x74/0x2d0 (?:?)
__fget_files+0x135/0x220 (?:?)
ksys_write+0x15a/0x180 (?:?)
rcu_is_watching+0x24/0x60 (?:?)
__x64_sys_write+0x46/0x60 (?:?)
x64_sys_call+0x7d/0x20d0 (?:?)
do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb
(git)
Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 0cb1ad795570167558530d6194297ac2396a1991 (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < ef46b616a4c219185bbf10ebcbacb571583fd0e4 (git) Affected: 81fd444aa371261cd33f31d4ffd80faeeeab0cc9 , < 60a1969fae6209644698fca91c185d153674f631 (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_ump_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb",
"status": "affected",
"version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
"versionType": "git"
},
{
"lessThan": "0cb1ad795570167558530d6194297ac2396a1991",
"status": "affected",
"version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
"versionType": "git"
},
{
"lessThan": "3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b",
"status": "affected",
"version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
"versionType": "git"
},
{
"lessThan": "ef46b616a4c219185bbf10ebcbacb571583fd0e4",
"status": "affected",
"version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
"versionType": "git"
},
{
"lessThan": "60a1969fae6209644698fca91c185d153674f631",
"status": "affected",
"version": "81fd444aa371261cd33f31d4ffd80faeeeab0cc9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_ump_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Serialize UMP output teardown with event_input\n\nseq_ump_process_event() borrows client-\u003eout_rfile.output without\nsynchronizing with the first-open and last-close transition in\nseq_ump_client_open() and seq_ump_client_close().\n\nThe last output unuse can therefore drop opened[STR_OUT] to zero and\nrelease the rawmidi file while an in-flight event_input callback is still\ninside snd_rawmidi_kernel_write(). That leaves the rawmidi substream\nruntime exposed to teardown before the write path has taken its own\nbuffer reference.\n\nAdd a per-client rwlock for the event_input-visible output file. Publish\na newly opened output file under the write side, and hold the read side\nfrom the output lookup through snd_rawmidi_kernel_write(). The last\noutput close copies and clears the visible output file under the write\nside, then drops the lock and releases the saved rawmidi file. Use\nIRQ-safe rwlock guards because event_input can also be reached from\natomic sequencer delivery.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\npath A label: event_input path path B label: last unuse path\n1. seq_ump_process_event() reads 1. seq_ump_client_close()\n client-\u003eout_rfile.output. drops opened[STR_OUT] to zero.\n2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release()\n has not yet pinned runtime. closes the output file.\n3. The writer continues using 3. close_substream() frees\n the borrowed substream. substream-\u003eruntime.\n\nThis keeps the output substream and runtime alive for the full\nevent_input write while keeping rawmidi release outside the rwlock.\n\nKASAN reproduced this as a slab-use-after-free in\nsnd_rawmidi_kernel_write1(), with allocation through\nseq_ump_use()/snd_seq_port_connect() and free through\nseq_ump_unuse()/snd_seq_port_disconnect().\n\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400\nRIP: 0033:0x7f5528af837f\nRead of size 8\nCall trace:\n dump_stack_lvl+0x73/0xb0 (?:?)\n print_report+0xd1/0x650 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x1a7/0x340 (?:?)\n kasan_complete_mode_report_info+0x64/0x200 (?:?)\n kasan_report+0xf7/0x130 (?:?)\n snd_rawmidi_kernel_write1+0x9d/0x400 (?:?)\n __asan_load8+0x82/0xb0 (?:?)\n update_stack_state+0x1ef/0x2d0 (?:?)\n snd_rawmidi_kernel_write+0x1a/0x20 (?:?)\n seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82)\n __snd_seq_deliver_single_event+0x8a/0xe0 (?:?)\n snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?)\n lock_acquire+0x14e/0x2e0 (?:?)\n find_held_lock+0x31/0x90 (?:?)\n snd_seq_port_use_ptr+0xa6/0xe0 (?:?)\n __kasan_check_write+0x18/0x20 (?:?)\n do_raw_read_unlock+0x32/0xa0 (?:?)\n _raw_read_unlock+0x26/0x50 (?:?)\n snd_seq_deliver_single_event+0x45c/0x4b0 (?:?)\n snd_seq_deliver_event+0x10d/0x1b0 (?:?)\n snd_seq_client_enqueue_event+0x192/0x240 (?:?)\n snd_seq_write+0x2cd/0x450 (?:?)\n apparmor_file_permission+0x20/0x30 (?:?)\n security_file_permission+0x51/0x60 (?:?)\n vfs_write+0x1ce/0x850 (?:?)\n __fget_files+0x12b/0x220 (?:?)\n lock_release+0xc8/0x2a0 (?:?)\n __rcu_read_unlock+0x74/0x2d0 (?:?)\n __fget_files+0x135/0x220 (?:?)\n ksys_write+0x15a/0x180 (?:?)\n rcu_is_watching+0x24/0x60 (?:?)\n __x64_sys_write+0x46/0x60 (?:?)\n x64_sys_call+0x7d/0x20d0 (?:?)\n do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime-\u003ebuffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:23.130Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb"
},
{
"url": "https://git.kernel.org/stable/c/0cb1ad795570167558530d6194297ac2396a1991"
},
{
"url": "https://git.kernel.org/stable/c/3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b"
},
{
"url": "https://git.kernel.org/stable/c/ef46b616a4c219185bbf10ebcbacb571583fd0e4"
},
{
"url": "https://git.kernel.org/stable/c/60a1969fae6209644698fca91c185d153674f631"
}
],
"title": "ALSA: seq: Serialize UMP output teardown with event_input",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64029",
"datePublished": "2026-07-19T15:39:20.368Z",
"dateReserved": "2026-07-19T07:54:57.028Z",
"dateUpdated": "2026-08-05T12:38:23.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64174 (GCVE-0-2026-64174)
Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-07-19 15:40
VLAI
EPSS
VEX
Title
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS
profile that has been split across multiple consecutive MBSSID elements.
Its while-loop calls
cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)
but never advances mbssid_elem or sub_elem inside the body. Each
iteration therefore searches for a continuation that follows the same
fixed pair; the helper returns the same next_mbssid; and the same
next_sub bytes are memcpy()'d into merged_ie at a growing offset until
the buffer fills.
Advance both mbssid_elem and sub_elem to the just-consumed continuation
so the next call to cfg80211_get_profile_continuation() searches for a
further continuation beyond it (or returns NULL when none exists).
A specially-crafted malicious beacon can take advantage of this bug
to cause the kernel to spend an excessive amount of time in
cfg80211_merge_profile (up to as much as 2ms per beacon received),
which could theoretically be abused in some way.
Severity
No CVSS data available.
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/5817e1e5205498a5d… | |
| https://git.kernel.org/stable/c/cedbb608494ba1e7a… | |
| https://git.kernel.org/stable/c/c0bc4c8bd556cbe03… | |
| https://git.kernel.org/stable/c/1ced0f5a851f9cae2… | |
| https://git.kernel.org/stable/c/67915715fd3874057… | |
| https://git.kernel.org/stable/c/6cfae4914439878b8… | |
| https://git.kernel.org/stable/c/1343a480f84b80c12… | |
| https://git.kernel.org/stable/c/7666dbb1bacc4ba52… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fe806e4992c9047affd263bcc13b2c047029a726 , < 5817e1e5205498a5df66eba2b34e817f4210fd0f
(git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < cedbb608494ba1e7a5c6c56b7f1d3fd470094f28 (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8 (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 1ced0f5a851f9cae274545a42a06c459b7fd8881 (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 67915715fd3874057457363c87c63e18829527df (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 6cfae4914439878b8acb35c7e3b40096eeb2ad9c (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 1343a480f84b80c1249133a90ef87f8751d65cbb (git) Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 7666dbb1bacc4ba522b96740cba7283d243d16e1 (git) |
|
| Linux | Linux |
Affected:
5.2
Unaffected: 0 , < 5.2 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5817e1e5205498a5df66eba2b34e817f4210fd0f",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "cedbb608494ba1e7a5c6c56b7f1d3fd470094f28",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "1ced0f5a851f9cae274545a42a06c459b7fd8881",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "67915715fd3874057457363c87c63e18829527df",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "6cfae4914439878b8acb35c7e3b40096eeb2ad9c",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "1343a480f84b80c1249133a90ef87f8751d65cbb",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
},
{
"lessThan": "7666dbb1bacc4ba522b96740cba7283d243d16e1",
"status": "affected",
"version": "fe806e4992c9047affd263bcc13b2c047029a726",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: advance loop vars in cfg80211_merge_profile()\n\ncfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS\nprofile that has been split across multiple consecutive MBSSID elements.\nIts while-loop calls\n\n\tcfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)\n\nbut never advances mbssid_elem or sub_elem inside the body. Each\niteration therefore searches for a continuation that follows the same\nfixed pair; the helper returns the same next_mbssid; and the same\nnext_sub bytes are memcpy()\u0027d into merged_ie at a growing offset until\nthe buffer fills.\n\nAdvance both mbssid_elem and sub_elem to the just-consumed continuation\nso the next call to cfg80211_get_profile_continuation() searches for a\nfurther continuation beyond it (or returns NULL when none exists).\n\nA specially-crafted malicious beacon can take advantage of this bug\nto cause the kernel to spend an excessive amount of time in\ncfg80211_merge_profile (up to as much as 2ms per beacon received),\nwhich could theoretically be abused in some way."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T15:40:59.360Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f"
},
{
"url": "https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28"
},
{
"url": "https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8"
},
{
"url": "https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881"
},
{
"url": "https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df"
},
{
"url": "https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c"
},
{
"url": "https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb"
},
{
"url": "https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1"
}
],
"title": "wifi: cfg80211: advance loop vars in cfg80211_merge_profile()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64174",
"datePublished": "2026-07-19T15:40:59.360Z",
"dateReserved": "2026-07-19T07:54:57.039Z",
"dateUpdated": "2026-07-19T15:40:59.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64175 (GCVE-0-2026-64175)
Vulnerability from cvelistv5 – Published: 2026-07-19 15:41 – Updated: 2026-08-05 12:39
VLAI
EPSS
VEX
Title
wifi: iwlwifi: mld: stop TX during firmware restart
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: stop TX during firmware restart
When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel
BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart
to true. However, iwl_mld_tx_from_txq() does not check this flag before
dequeuing frames from mac80211 and pushing them to the transport layer.
Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame,
which then gets freed immediately. Under high-throughput conditions
(e.g., Tailscale UDP traffic or active SSH sessions), this creates a
tight dequeue-send-fail-free loop that wastes CPU cycles and generates
rapid skb allocation churn, leading to memory pressure from slab
fragmentation.
The RX path already has this guard (iwl_mld_rx_mpdu checks
in_hw_restart at rx.c:1906), and so does the TXQ allocation worker
(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to
iwl_mld_tx_from_txq() to stop all TX during firmware restart.
Frames left in mac80211's TXQs are naturally drained after restart
completes, when queue reallocation triggers iwl_mld_tx_from_txq()
via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes
wake_tx_queue.
Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on
kernel 6.19.5 where the firmware crashes approximately every 10-15
minutes under Tailscale traffic.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d1e879ec600f9b3bdd253167533959facfefb17b , < dc31c69476520bb4c2a208211a8d3c310a62c4d0
(git)
Affected: d1e879ec600f9b3bdd253167533959facfefb17b , < 13f1786395dbbf3df73337063c798f1266be6151 (git) Affected: d1e879ec600f9b3bdd253167533959facfefb17b , < 2becb38a3e217ef2b2f42fddd7db7a25905ec291 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mld/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dc31c69476520bb4c2a208211a8d3c310a62c4d0",
"status": "affected",
"version": "d1e879ec600f9b3bdd253167533959facfefb17b",
"versionType": "git"
},
{
"lessThan": "13f1786395dbbf3df73337063c798f1266be6151",
"status": "affected",
"version": "d1e879ec600f9b3bdd253167533959facfefb17b",
"versionType": "git"
},
{
"lessThan": "2becb38a3e217ef2b2f42fddd7db7a25905ec291",
"status": "affected",
"version": "d1e879ec600f9b3bdd253167533959facfefb17b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mld/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld-\u003efw_status.in_hw_restart\nto true. However, iwl_mld_tx_from_txq() does not check this flag before\ndequeuing frames from mac80211 and pushing them to the transport layer.\n\nSince the firmware is dead, iwl_trans_tx() returns -EIO for each frame,\nwhich then gets freed immediately. Under high-throughput conditions\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates\nrapid skb allocation churn, leading to memory pressure from slab\nfragmentation.\n\nThe RX path already has this guard (iwl_mld_rx_mpdu checks\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to\niwl_mld_tx_from_txq() to stop all TX during firmware restart.\n\nFrames left in mac80211\u0027s TXQs are naturally drained after restart\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes\nwake_tx_queue.\n\nTested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on\nkernel 6.19.5 where the firmware crashes approximately every 10-15\nminutes under Tailscale traffic."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when outbound traffic drives mac80211 TX during firmware restart; a remote attacker can sustain that by sending high-volume packets to the victim over the network, causing responses and continued TX without local access.\nAC:L - An attacker can reliably generate sustained high-throughput traffic that both stresses the iwlwifi MLD firmware and keeps TX queues active during the restart window; on affected Intel Wi-Fi 7 hardware firmware crashes occur frequently under such load.\nPR:N - Exploitation requires only the ability to send network traffic to the victim; no local account, kernel capabilities, or authentication is needed to keep the TX dequeue loop running during firmware restart.\nUI:N - No victim interaction beyond normal network connectivity is required; the attacker can trigger the condition by flooding or sustaining traffic to the target.\nS:U - Impact is confined to kernel/driver resource exhaustion on the affected host and does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The flaw causes skb allocate/free churn and CPU waste but does not corrupt memory, leak kernel data, or provide an out-of-bounds or use-after-free read primitive.\nI:N - Failed transmits are dropped and freed cleanly; there is no arbitrary write, code execution, or integrity compromise beyond dropped packets during the restart window.\nA:H - The missing guard creates a tight dequeue-send-fail-free loop under high throughput during firmware restart, wasting CPU and causing memory pressure from slab fragmentation that can render the system effectively unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:53.411Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0"
},
{
"url": "https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151"
},
{
"url": "https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291"
}
],
"title": "wifi: iwlwifi: mld: stop TX during firmware restart",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64175",
"datePublished": "2026-07-19T15:41:00.157Z",
"dateReserved": "2026-07-19T07:54:57.039Z",
"dateUpdated": "2026-08-05T12:39:53.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…