Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
13630 vulnerabilities
CVE-2026-64529 (GCVE-0-2026-64529)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:24 – Updated: 2026-07-25 09:24
VLAI
EPSS
VEX
Title
crypto: qat - remove unused character device and IOCTLs
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - remove unused character device and IOCTLs
The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.
The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.
Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.
Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.
Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 071590a44cbc38483fceb1ab943363ec26868e1b
(git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 1de076f43e64bf65fbe7280a269c70e0e60518df (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 6848a6e39cac44fdb7cb88f0f777df62172d1551 (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < b1ea97076bd0a5196290deba172034e480646727 (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < b8ebf008696de1ec08c90d51f94d7e40bd448be1 (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < de2cc38489b629927910b1aeff69bba7bd5c6f1b (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 3ae49dd04dbb11fb73f17f58a982dba128abe83a (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < d237230728c567297f2f98b425d63156ab2ed17f (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/userspace-api/ioctl/ioctl-number.rst",
"drivers/crypto/intel/qat/qat_common/adf_cfg.c",
"drivers/crypto/intel/qat/qat_common/adf_cfg.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
"drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "071590a44cbc38483fceb1ab943363ec26868e1b",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "1de076f43e64bf65fbe7280a269c70e0e60518df",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "6848a6e39cac44fdb7cb88f0f777df62172d1551",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "b1ea97076bd0a5196290deba172034e480646727",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "b8ebf008696de1ec08c90d51f94d7e40bd448be1",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "de2cc38489b629927910b1aeff69bba7bd5c6f1b",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "3ae49dd04dbb11fb73f17f58a982dba128abe83a",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "d237230728c567297f2f98b425d63156ab2ed17f",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/userspace-api/ioctl/ioctl-number.rst",
"drivers/crypto/intel/qat/qat_common/adf_cfg.c",
"drivers/crypto/intel/qat/qat_common/adf_cfg.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
"drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - remove unused character device and IOCTLs\n\nThe QAT driver exposes a character device (qat_adf_ctl) with IOCTLs\nfor device configuration, start, stop, status query and enumeration.\nThese IOCTLs are not part of any public uAPI header and have no known\nin-tree or out-of-tree users. Device lifecycle is already managed via\nsysfs.\n\nThe ioctl interface also increases the attack surface and is the\nsubject of a number of bug reports.\n\nRemove the character device, the IOCTL definitions, and the related\ndata structures (adf_dev_status_info, adf_user_cfg_key_val,\nadf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused\nadf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal\nmodule_init/module_exit hooks for workqueue, AER, and crypto/compression\nalgorithm registration.\n\nClean up leftover dead code that was only reachable from the removed\nIOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),\nadf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),\nadf_get_vf_real_id() and the unused ADF_CFG macros.\n\nAdditionally, drop the entry associated to QAT IOCTLs in\nioctl-number.rst."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:24:18.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b"
},
{
"url": "https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df"
},
{
"url": "https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a"
},
{
"url": "https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551"
},
{
"url": "https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727"
},
{
"url": "https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1"
},
{
"url": "https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b"
},
{
"url": "https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a"
},
{
"url": "https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f"
}
],
"title": "crypto: qat - remove unused character device and IOCTLs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64529",
"datePublished": "2026-07-25T09:24:18.750Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:24:18.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64528 (GCVE-0-2026-64528)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-07-25 09:20
VLAI
EPSS
VEX
Title
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Summary
In the Linux kernel, the following vulnerability has been resolved:
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Sashiko identified a deadlock when the console flow is engaged [1].
When console flow control is enabled (UPF_CONS_FLOW),
s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and
s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable().
The serial core framework invokes the .stop_tx() and .start_tx()
callbacks with the port->lock spinlock already held. Furthermore, all
internal driver paths that invoke stop_tx (such as the DMA TX
completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ
handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to
calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the
serial core).
However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable()
unconditionally attempt to acquire port->lock again using
uart_port_lock_irqsave(). Since spinlocks are not recursive, this
causes a deadlock on the same CPU when console flow control is engaged.
Remove the redundant lock acquisition from both rx helper functions.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b497549a035c2a81b71c7a27f2b00c8a16c09423 , < ee9eb72be95490602c493db050c73d925c3a4d74
(git)
Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < 10014eb7eee351f7b587f8ac85830f0c9343cb9a (git) Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < f4c3e63fa8639aedf96fb200d9939945a9eed51e (git) Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < a9c22e0f93ba18322a6623ecdda2f0cd858ca350 (git) Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < 14143ec10d69f42806b5d7b046f0fd1b835831ae (git) Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < 9fd48937046efc9abb89379d63ee9cc5c661d711 (git) Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < 9c92b42207978559e32903c3098aaf5c5b5788b2 (git) Affected: b497549a035c2a81b71c7a27f2b00c8a16c09423 , < a3bb136bff5e6a5e48cdd813246c9c4686feaaa9 (git) |
|
| Linux | Linux |
Affected:
2.6.27
Unaffected: 0 , < 2.6.27 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/samsung_tty.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee9eb72be95490602c493db050c73d925c3a4d74",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "10014eb7eee351f7b587f8ac85830f0c9343cb9a",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "f4c3e63fa8639aedf96fb200d9939945a9eed51e",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "a9c22e0f93ba18322a6623ecdda2f0cd858ca350",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "14143ec10d69f42806b5d7b046f0fd1b835831ae",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "9fd48937046efc9abb89379d63ee9cc5c661d711",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "9c92b42207978559e32903c3098aaf5c5b5788b2",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
},
{
"lessThan": "a3bb136bff5e6a5e48cdd813246c9c4686feaaa9",
"status": "affected",
"version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/samsung_tty.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n\nSashiko identified a deadlock when the console flow is engaged [1].\n\nWhen console flow control is enabled (UPF_CONS_FLOW),\ns3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and\ns3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable().\n\nThe serial core framework invokes the .stop_tx() and .start_tx()\ncallbacks with the port-\u003elock spinlock already held. Furthermore, all\ninternal driver paths that invoke stop_tx (such as the DMA TX\ncompletion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ\nhandler s3c24xx_serial_tx_irq()) also acquire port-\u003elock prior to\ncalling it. (Note that s3c24xx_serial_start_tx() is only invoked by the\nserial core).\n\nHowever, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable()\nunconditionally attempt to acquire port-\u003elock again using\nuart_port_lock_irqsave(). Since spinlocks are not recursive, this\ncauses a deadlock on the same CPU when console flow control is engaged.\n\nRemove the redundant lock acquisition from both rx helper functions."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:20:51.774Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee9eb72be95490602c493db050c73d925c3a4d74"
},
{
"url": "https://git.kernel.org/stable/c/10014eb7eee351f7b587f8ac85830f0c9343cb9a"
},
{
"url": "https://git.kernel.org/stable/c/f4c3e63fa8639aedf96fb200d9939945a9eed51e"
},
{
"url": "https://git.kernel.org/stable/c/a9c22e0f93ba18322a6623ecdda2f0cd858ca350"
},
{
"url": "https://git.kernel.org/stable/c/14143ec10d69f42806b5d7b046f0fd1b835831ae"
},
{
"url": "https://git.kernel.org/stable/c/9fd48937046efc9abb89379d63ee9cc5c661d711"
},
{
"url": "https://git.kernel.org/stable/c/9c92b42207978559e32903c3098aaf5c5b5788b2"
},
{
"url": "https://git.kernel.org/stable/c/a3bb136bff5e6a5e48cdd813246c9c4686feaaa9"
}
],
"title": "tty: serial: samsung: Remove redundant port lock acquisition in rx helpers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64528",
"datePublished": "2026-07-25T09:20:51.774Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:20:51.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64527 (GCVE-0-2026-64527)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-07-25 09:20
VLAI
EPSS
VEX
Title
drm/hyperv: validate VMBus packet size in receive callback
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/hyperv: validate VMBus packet size in receive callback
hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one
of four message-type branches without knowing how many bytes the host
wrote into hv->recv_buf. The completion path then runs
memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that
wakes on wait_for_completion_timeout() can read up to 16 KiB of
residue from a prior message as if it were the response payload.
Pass bytes_recvd into hyperv_receive_sub() and reject any packet that
does not cover the pipe + synthvid header. A single switch on
msg->vid_hdr.type then computes the type-specific payload size: the
three completion-driving types (SYNTHVID_VERSION_RESPONSE,
SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through
to a shared exit that requires that size before memcpy/complete, while
SYNTHVID_FEATURE_CHANGE validates its own payload and returns before
reading is_dirt_needed. Unknown types are dropped.
SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills
resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT
array. Validate the fixed prefix first so resolution_count can be
read, bound it against the array, then require only the count-sized
array, so the shorter responses the host actually sends are accepted.
Only run the sub-handler when vmbus_recvpacket() returned success. The
memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE
only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead
reports the required length, which can exceed hv->recv_buf, so copying
bytes_recvd would read and write past the 16 KiB buffers. Gating on the
success return keeps the copy bounded. The nonzero-return path is itself
a malformed-message case and is now logged rather than silently skipped;
channel recovery is not attempted.
Rejected packets are reported via drm_err_ratelimited() rather than
silently dropped, matching the CoCo-hardened pattern in
hv_kvp_onchannelcallback().
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 57d5d697642e05d5dd2d40660817765943dd709f
(git)
Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < f5251226551bfec98c4705641b6f94ff1f238d91 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 049a6b474823049fe60212f25f26e4b30f44ee8f (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 588c84b461393ff1998ac7b97b04f953f642e0df (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 164dc7bf17609340233c6bf4f66bb7c7008a0511 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < c8974d96b6a5496f33dc69a3ce28a7bf5078def4 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 7f87763f47a3c22fb50265a00619ef10f2394b18 (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/hyperv/hyperv_drm_proto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57d5d697642e05d5dd2d40660817765943dd709f",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "f5251226551bfec98c4705641b6f94ff1f238d91",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "049a6b474823049fe60212f25f26e4b30f44ee8f",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "588c84b461393ff1998ac7b97b04f953f642e0df",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "164dc7bf17609340233c6bf4f66bb7c7008a0511",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "c8974d96b6a5496f33dc69a3ce28a7bf5078def4",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "7f87763f47a3c22fb50265a00619ef10f2394b18",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/hyperv/hyperv_drm_proto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hyperv: validate VMBus packet size in receive callback\n\nhyperv_receive_sub() reads msg-\u003evid_hdr.type and dispatches into one\nof four message-type branches without knowing how many bytes the host\nwrote into hv-\u003erecv_buf. The completion path then runs\nmemcpy(hv-\u003einit_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that\nwakes on wait_for_completion_timeout() can read up to 16 KiB of\nresidue from a prior message as if it were the response payload.\n\nPass bytes_recvd into hyperv_receive_sub() and reject any packet that\ndoes not cover the pipe + synthvid header. A single switch on\nmsg-\u003evid_hdr.type then computes the type-specific payload size: the\nthree completion-driving types (SYNTHVID_VERSION_RESPONSE,\nSYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through\nto a shared exit that requires that size before memcpy/complete, while\nSYNTHVID_FEATURE_CHANGE validates its own payload and returns before\nreading is_dirt_needed. Unknown types are dropped.\n\nSYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills\nresolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT\narray. Validate the fixed prefix first so resolution_count can be\nread, bound it against the array, then require only the count-sized\narray, so the shorter responses the host actually sends are accepted.\n\nOnly run the sub-handler when vmbus_recvpacket() returned success. The\nmemcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE\nonly on a successful receive; on -ENOBUFS vmbus_recvpacket() instead\nreports the required length, which can exceed hv-\u003erecv_buf, so copying\nbytes_recvd would read and write past the 16 KiB buffers. Gating on the\nsuccess return keeps the copy bounded. The nonzero-return path is itself\na malformed-message case and is now logged rather than silently skipped;\nchannel recovery is not attempted.\n\nRejected packets are reported via drm_err_ratelimited() rather than\nsilently dropped, matching the CoCo-hardened pattern in\nhv_kvp_onchannelcallback()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:20:51.078Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f"
},
{
"url": "https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91"
},
{
"url": "https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f"
},
{
"url": "https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df"
},
{
"url": "https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511"
},
{
"url": "https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4"
},
{
"url": "https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18"
}
],
"title": "drm/hyperv: validate VMBus packet size in receive callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64527",
"datePublished": "2026-07-25T09:20:51.078Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:20:51.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64526 (GCVE-0-2026-64526)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-07-25 09:20
VLAI
EPSS
VEX
Title
ethtool: tsconfig: fix missing ethnl_ops_complete()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ethtool: tsconfig: fix missing ethnl_ops_complete()
tsconfig_prepare_data() calls ethnl_ops_begin(), we need to call
ethnl_ops_complete() before returning the error.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6e9e2eed4f39d52edf5fd006409d211facf49f6b , < d02342d9bb4f0ab682f1846a4fbc15dd2955f7e6
(git)
Affected: 6e9e2eed4f39d52edf5fd006409d211facf49f6b , < d53fe379d1f9a92e8a1bb2556084c8c177ebf8fd (git) Affected: 6e9e2eed4f39d52edf5fd006409d211facf49f6b , < 6386bd772de64e6760306eb91c7e86163af6c22f (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ethtool/tsconfig.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d02342d9bb4f0ab682f1846a4fbc15dd2955f7e6",
"status": "affected",
"version": "6e9e2eed4f39d52edf5fd006409d211facf49f6b",
"versionType": "git"
},
{
"lessThan": "d53fe379d1f9a92e8a1bb2556084c8c177ebf8fd",
"status": "affected",
"version": "6e9e2eed4f39d52edf5fd006409d211facf49f6b",
"versionType": "git"
},
{
"lessThan": "6386bd772de64e6760306eb91c7e86163af6c22f",
"status": "affected",
"version": "6e9e2eed4f39d52edf5fd006409d211facf49f6b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ethtool/tsconfig.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: tsconfig: fix missing ethnl_ops_complete()\n\ntsconfig_prepare_data() calls ethnl_ops_begin(), we need to call\nethnl_ops_complete() before returning the error."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:20:50.394Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d02342d9bb4f0ab682f1846a4fbc15dd2955f7e6"
},
{
"url": "https://git.kernel.org/stable/c/d53fe379d1f9a92e8a1bb2556084c8c177ebf8fd"
},
{
"url": "https://git.kernel.org/stable/c/6386bd772de64e6760306eb91c7e86163af6c22f"
}
],
"title": "ethtool: tsconfig: fix missing ethnl_ops_complete()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64526",
"datePublished": "2026-07-25T09:20:50.394Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:20:50.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64525 (GCVE-0-2026-64525)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-07-25 09:20
VLAI
EPSS
VEX
Title
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
The struct pernet_operations docstring in include/net/net_namespace.h
explicitly warns against blocking RCU primitives in .exit handlers:
Exit methods using blocking RCU primitives, such as
synchronize_rcu(), should be implemented via exit_batch.
[...]
Please, avoid synchronize_rcu() at all, where it's possible.
Note that a combination of pre_exit() and exit() can
be used, since a synchronize_rcu() is guaranteed between
the calls.
xfrm_policy_fini() violates this: it calls synchronize_rcu() before
freeing the policy_bydst hash tables (so no RCU reader is mid-
traversal at free time), but runs from xfrm_net_ops.exit -- once per
namespace -- so a cleanup_net() of N namespaces pays N full RCU
grace periods serially.
Use the documented pre_exit/exit split. Move the policy flush (and
the workqueue drains it depends on) into a new .pre_exit handler;
xfrm_policy_fini() then runs in .exit and frees the hash tables
after the synchronize_rcu_expedited() that cleanup_net() guarantees
between the two phases. Providing O(1) RCU grace periods per batch
instead of O(N).
Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET)
at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread
both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct
net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed
to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and
__put_net counts were balanced, ruling out a refcount leak.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
438b1f668ad58f46ce699bb48e4698a7839e3f9e , < bca6386dc08750fc7cdcbc7683473748ba3114b9
(git)
Affected: 3733fce2871c9bca9dd18a1a23b1432ea215a094 , < 91cc13978ab0bc6f669139f53e7e613a860d10e0 (git) Affected: 069daad4f2ae9c5c108131995529d5f02392c446 , < d14ae8ef88c2c6590e107db61b6adce148cec7b3 (git) Affected: 069daad4f2ae9c5c108131995529d5f02392c446 , < 3e52417318473782012b236d0325bf7d2266a597 (git) Affected: b66920a3348c0f63ba18365248fa21fbf0b3a937 (git) Affected: 33a3149dd81a1e2f52b80ee1e0fc380b39f3d028 (git) Affected: 6.12.83 , < 6.12.93 (semver) Affected: 6.18.24 , < 6.18.35 (semver) Affected: 6.6.136 , < 6.7 (semver) Affected: 6.19.14 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bca6386dc08750fc7cdcbc7683473748ba3114b9",
"status": "affected",
"version": "438b1f668ad58f46ce699bb48e4698a7839e3f9e",
"versionType": "git"
},
{
"lessThan": "91cc13978ab0bc6f669139f53e7e613a860d10e0",
"status": "affected",
"version": "3733fce2871c9bca9dd18a1a23b1432ea215a094",
"versionType": "git"
},
{
"lessThan": "d14ae8ef88c2c6590e107db61b6adce148cec7b3",
"status": "affected",
"version": "069daad4f2ae9c5c108131995529d5f02392c446",
"versionType": "git"
},
{
"lessThan": "3e52417318473782012b236d0325bf7d2266a597",
"status": "affected",
"version": "069daad4f2ae9c5c108131995529d5f02392c446",
"versionType": "git"
},
{
"status": "affected",
"version": "b66920a3348c0f63ba18365248fa21fbf0b3a937",
"versionType": "git"
},
{
"status": "affected",
"version": "33a3149dd81a1e2f52b80ee1e0fc380b39f3d028",
"versionType": "git"
},
{
"lessThan": "6.12.93",
"status": "affected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThan": "6.18.35",
"status": "affected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.12.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.18.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit\n\nThe struct pernet_operations docstring in include/net/net_namespace.h\nexplicitly warns against blocking RCU primitives in .exit handlers:\n\n Exit methods using blocking RCU primitives, such as\n synchronize_rcu(), should be implemented via exit_batch.\n [...]\n Please, avoid synchronize_rcu() at all, where it\u0027s possible.\n\n Note that a combination of pre_exit() and exit() can\n be used, since a synchronize_rcu() is guaranteed between\n the calls.\n\nxfrm_policy_fini() violates this: it calls synchronize_rcu() before\nfreeing the policy_bydst hash tables (so no RCU reader is mid-\ntraversal at free time), but runs from xfrm_net_ops.exit -- once per\nnamespace -- so a cleanup_net() of N namespaces pays N full RCU\ngrace periods serially.\n\nUse the documented pre_exit/exit split. Move the policy flush (and\nthe workqueue drains it depends on) into a new .pre_exit handler;\nxfrm_policy_fini() then runs in .exit and frees the hash tables\nafter the synchronize_rcu_expedited() that cleanup_net() guarantees\nbetween the two phases. Providing O(1) RCU grace periods per batch\ninstead of O(N).\n\nObserved on Linux 6.18 with a workload doing unshare(CLONE_NEWNET)\nat ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread\nboth stuck in xfrm_policy_fini()\u0027s synchronize_rcu(), \u003e300k struct\nnet accumulated in the cleanup queue, Percpu in /proc/meminfo climbed\nto 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and\n__put_net counts were balanced, ruling out a refcount leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:20:49.256Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bca6386dc08750fc7cdcbc7683473748ba3114b9"
},
{
"url": "https://git.kernel.org/stable/c/91cc13978ab0bc6f669139f53e7e613a860d10e0"
},
{
"url": "https://git.kernel.org/stable/c/d14ae8ef88c2c6590e107db61b6adce148cec7b3"
},
{
"url": "https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597"
}
],
"title": "xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64525",
"datePublished": "2026-07-25T09:20:49.256Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:20:49.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64524 (GCVE-0-2026-64524)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-07-25 09:20
VLAI
EPSS
VEX
Title
drm/hyperv: validate resolution_count and fix WIN8 fallback
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/hyperv: validate resolution_count and fix WIN8 fallback
A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past
the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the
parse loop. Bound resolution_count against the array size, folded
into the existing zero-check.
When the WIN10 resolution probe fails, the caller in
hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated,
which sets mode_config.max_width / max_height to 0 and makes
drm_internal_framebuffer_create() reject every userspace framebuffer
with -EINVAL. The pre-WIN10 branch had the same gap for
preferred_width / preferred_height. Use a single post-probe fallback
guarded by screen_width_max == 0 so both paths converge on the WIN8
defaults.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 96f7de3172d4aa878b7f87173b2b3507c350fcd6
(git)
Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < bc573752f3dac0d1ab8df7078c1851bc76717653 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 1fb565b77b8f44afabb02de6310065f109d89e94 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < a321c908f2eeea01539668eb270d074d9b88e490 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 9c698b2c43c2667c34f5336bf46ad5786216ac2a (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 8a114b25b5521eae451b13bce98ae978624962e5 (git) Affected: 76c56a5affeba1e163b66b9d8cc192e6154466f0 , < 13d33b9ef67066c77c84273fac5a1d3fde3533d1 (git) |
|
| Linux | Linux |
Affected:
5.14
Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/hyperv/hyperv_drm_proto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96f7de3172d4aa878b7f87173b2b3507c350fcd6",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "bc573752f3dac0d1ab8df7078c1851bc76717653",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "1fb565b77b8f44afabb02de6310065f109d89e94",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "a321c908f2eeea01539668eb270d074d9b88e490",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "9c698b2c43c2667c34f5336bf46ad5786216ac2a",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "8a114b25b5521eae451b13bce98ae978624962e5",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
},
{
"lessThan": "13d33b9ef67066c77c84273fac5a1d3fde3533d1",
"status": "affected",
"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/hyperv/hyperv_drm_proto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hyperv: validate resolution_count and fix WIN8 fallback\n\nA SYNTHVID_RESOLUTION_RESPONSE with resolution_count \u003e 64 walks past\nthe supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the\nparse loop. Bound resolution_count against the array size, folded\ninto the existing zero-check.\n\nWhen the WIN10 resolution probe fails, the caller in\nhyperv_connect_vsp() left hv-\u003escreen_*_max / preferred_* unpopulated,\nwhich sets mode_config.max_width / max_height to 0 and makes\ndrm_internal_framebuffer_create() reject every userspace framebuffer\nwith -EINVAL. The pre-WIN10 branch had the same gap for\npreferred_width / preferred_height. Use a single post-probe fallback\nguarded by screen_width_max == 0 so both paths converge on the WIN8\ndefaults."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:20:48.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96f7de3172d4aa878b7f87173b2b3507c350fcd6"
},
{
"url": "https://git.kernel.org/stable/c/bc573752f3dac0d1ab8df7078c1851bc76717653"
},
{
"url": "https://git.kernel.org/stable/c/1fb565b77b8f44afabb02de6310065f109d89e94"
},
{
"url": "https://git.kernel.org/stable/c/a321c908f2eeea01539668eb270d074d9b88e490"
},
{
"url": "https://git.kernel.org/stable/c/9c698b2c43c2667c34f5336bf46ad5786216ac2a"
},
{
"url": "https://git.kernel.org/stable/c/8a114b25b5521eae451b13bce98ae978624962e5"
},
{
"url": "https://git.kernel.org/stable/c/13d33b9ef67066c77c84273fac5a1d3fde3533d1"
}
],
"title": "drm/hyperv: validate resolution_count and fix WIN8 fallback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64524",
"datePublished": "2026-07-25T09:20:48.193Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:20:48.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64523 (GCVE-0-2026-64523)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-07-25 09:20
VLAI
EPSS
VEX
Title
net/handshake: Take a long-lived file reference at submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/handshake: Take a long-lived file reference at submit
handshake_nl_accept_doit() needs the file pointer backing
req->hr_sk->sk_socket to survive the window between
handshake_req_next() and the subsequent FD_PREPARE() and get_file().
The submit-side sock_hold() does not provide that. sk_refcnt keeps
struct sock alive, but struct socket is owned by sock->file: when
the consumer fputs the last file reference, sock_release() tears
the socket down regardless of any sock_hold.
Add an hr_file pointer to struct handshake_req and acquire an
explicit reference on sock->file during handshake_req_submit().
handshake_complete() and handshake_req_cancel() release the
reference on the completion-bit-winning path.
The submit error path must also release the file reference, but
after rhashtable insertion a concurrent handshake_req_cancel() can
discover the request and race the error path. Gate the error-path
cleanup -- sk_destruct restoration, fput, and request destruction
-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same
serialization handshake_complete() and handshake_req_cancel()
already use. When cancel has already claimed ownership, the submit
error path returns without touching the request; socket teardown
handles final destruction.
The accept-side dereferences are not yet retargeted; that change
comes in the next patch.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 685b10dd0e32c7782cead16c8cf055c609678583
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 16eaba5aa89c04eea125905bb8f988c1897f4f29 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 09dba37eee70d0596e26645015f1aa95a9848e9d (git) Affected: 0 , < 6.12.93 (semver) Affected: 0 , < 7.0.12 (semver) |
|
| Linux | Linux |
Unaffected:
6.12.93 , ≤ 6.12.*
(semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/handshake/handshake.h",
"net/handshake/netlink.c",
"net/handshake/request.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "685b10dd0e32c7782cead16c8cf055c609678583",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "16eaba5aa89c04eea125905bb8f988c1897f4f29",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "09dba37eee70d0596e26645015f1aa95a9848e9d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.12.93",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.0.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/handshake/handshake.h",
"net/handshake/netlink.c",
"net/handshake/request.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Take a long-lived file reference at submit\n\nhandshake_nl_accept_doit() needs the file pointer backing\nreq-\u003ehr_sk-\u003esk_socket to survive the window between\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\nThe submit-side sock_hold() does not provide that. sk_refcnt keeps\nstruct sock alive, but struct socket is owned by sock-\u003efile: when\nthe consumer fputs the last file reference, sock_release() tears\nthe socket down regardless of any sock_hold.\n\nAdd an hr_file pointer to struct handshake_req and acquire an\nexplicit reference on sock-\u003efile during handshake_req_submit().\nhandshake_complete() and handshake_req_cancel() release the\nreference on the completion-bit-winning path.\n\nThe submit error path must also release the file reference, but\nafter rhashtable insertion a concurrent handshake_req_cancel() can\ndiscover the request and race the error path. Gate the error-path\ncleanup -- sk_destruct restoration, fput, and request destruction\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\nserialization handshake_complete() and handshake_req_cancel()\nalready use. When cancel has already claimed ownership, the submit\nerror path returns without touching the request; socket teardown\nhandles final destruction.\n\nThe accept-side dereferences are not yet retargeted; that change\ncomes in the next patch."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:20:47.606Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583"
},
{
"url": "https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29"
},
{
"url": "https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d"
}
],
"title": "net/handshake: Take a long-lived file reference at submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64523",
"datePublished": "2026-07-25T09:20:47.606Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:20:47.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64522 (GCVE-0-2026-64522)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating
software state and skipping hardware offload setup.
That path jumps to the common success label before taking the eswitch mode
block. After tunnel-mode validation was moved earlier, the common success
label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs,
this decrements esw->offloads.num_block_mode without a matching increment.
Return directly after installing the acquire SA offload handle, so only the
paths that successfully called mlx5_eswitch_block_mode() call the matching
unblock.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 , < b5bd4249e430f5963d559708ee96a671716d2400
(git)
Affected: 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 , < ecafd8284e527666e83261e6e57a7c7341d591cb (git) Affected: 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 , < abe003b33223ff33552f291644bf35d9c2f992fb (git) Affected: 993c4ba71596c30418ba5a0ddcf4f9c2f431466a (git) Affected: 6.17.4 , < 6.18 (semver) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5bd4249e430f5963d559708ee96a671716d2400",
"status": "affected",
"version": "22239eb258bc1e6ccdb2d3502fce1cc2b2a88386",
"versionType": "git"
},
{
"lessThan": "ecafd8284e527666e83261e6e57a7c7341d591cb",
"status": "affected",
"version": "22239eb258bc1e6ccdb2d3502fce1cc2b2a88386",
"versionType": "git"
},
{
"lessThan": "abe003b33223ff33552f291644bf35d9c2f992fb",
"status": "affected",
"version": "22239eb258bc1e6ccdb2d3502fce1cc2b2a88386",
"versionType": "git"
},
{
"status": "affected",
"version": "993c4ba71596c30418ba5a0ddcf4f9c2f431466a",
"versionType": "git"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA\n\nmlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating\nsoftware state and skipping hardware offload setup.\n\nThat path jumps to the common success label before taking the eswitch mode\nblock. After tunnel-mode validation was moved earlier, the common success\nlabel unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs,\nthis decrements esw-\u003eoffloads.num_block_mode without a matching increment.\n\nReturn directly after installing the acquire SA offload handle, so only the\npaths that successfully called mlx5_eswitch_block_mode() call the matching\nunblock."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:47.404Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400"
},
{
"url": "https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb"
},
{
"url": "https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb"
}
],
"title": "net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64522",
"datePublished": "2026-07-25T09:14:47.404Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:47.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64521 (GCVE-0-2026-64521)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
pinctrl: meson: amlogic-a4: fix deadlock issue
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: meson: amlogic-a4: fix deadlock issue
Accessing the pinconf-pins sysfs node may deadlock.
pinconf_pins_show() holds pctldev->mutex, and the platform driver
calls pinctrl_find_gpio_range_from_pin(), which tries to acquire
the same mutex again, leading to a deadlock.
Use pinctrl_find_gpio_range_from_pin_nolock() to fix this issue.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6e9be3abb78c2f6c97a51070004a5165702f0ed9 , < e917713f013423069782ff554935c7a5d4266783
(git)
Affected: 6e9be3abb78c2f6c97a51070004a5165702f0ed9 , < 744ac926c0e55267a10b49b5b72582afef4ad49f (git) Affected: 6e9be3abb78c2f6c97a51070004a5165702f0ed9 , < e72ce029810390eb987a036fb2c8a5da9a23b685 (git) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/meson/pinctrl-amlogic-a4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e917713f013423069782ff554935c7a5d4266783",
"status": "affected",
"version": "6e9be3abb78c2f6c97a51070004a5165702f0ed9",
"versionType": "git"
},
{
"lessThan": "744ac926c0e55267a10b49b5b72582afef4ad49f",
"status": "affected",
"version": "6e9be3abb78c2f6c97a51070004a5165702f0ed9",
"versionType": "git"
},
{
"lessThan": "e72ce029810390eb987a036fb2c8a5da9a23b685",
"status": "affected",
"version": "6e9be3abb78c2f6c97a51070004a5165702f0ed9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/meson/pinctrl-amlogic-a4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: meson: amlogic-a4: fix deadlock issue\n\nAccessing the pinconf-pins sysfs node may deadlock.\n\npinconf_pins_show() holds pctldev-\u003emutex, and the platform driver\ncalls pinctrl_find_gpio_range_from_pin(), which tries to acquire\nthe same mutex again, leading to a deadlock.\n\nUse pinctrl_find_gpio_range_from_pin_nolock() to fix this issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:46.709Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e917713f013423069782ff554935c7a5d4266783"
},
{
"url": "https://git.kernel.org/stable/c/744ac926c0e55267a10b49b5b72582afef4ad49f"
},
{
"url": "https://git.kernel.org/stable/c/e72ce029810390eb987a036fb2c8a5da9a23b685"
}
],
"title": "pinctrl: meson: amlogic-a4: fix deadlock issue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64521",
"datePublished": "2026-07-25T09:14:46.709Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:46.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64520 (GCVE-0-2026-64520)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
The register-based PARTITION_INFO_GET path trusted the firmware-provided
indices when copying partition descriptors into the caller buffer.
Reject inconsistent counts or index progressions so the copy loop cannot
write past the allocated array.
(fixed cur_idx when exactly one descriptor in the first fragment)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ba85c644ac8dc37d9b01a3332c2f142cb4d46954 , < f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95
(git)
Affected: ba85c644ac8dc37d9b01a3332c2f142cb4d46954 , < 79d95c02ae0a95e6e80e8e92b7ca74ecee02854f (git) Affected: ba85c644ac8dc37d9b01a3332c2f142cb4d46954 , < 3974ea1938406f9bfa7c1f48d4e43533f447bb08 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95",
"status": "affected",
"version": "ba85c644ac8dc37d9b01a3332c2f142cb4d46954",
"versionType": "git"
},
{
"lessThan": "79d95c02ae0a95e6e80e8e92b7ca74ecee02854f",
"status": "affected",
"version": "ba85c644ac8dc37d9b01a3332c2f142cb4d46954",
"versionType": "git"
},
{
"lessThan": "3974ea1938406f9bfa7c1f48d4e43533f447bb08",
"status": "affected",
"version": "ba85c644ac8dc37d9b01a3332c2f142cb4d46954",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies\n\nThe register-based PARTITION_INFO_GET path trusted the firmware-provided\nindices when copying partition descriptors into the caller buffer.\nReject inconsistent counts or index progressions so the copy loop cannot\nwrite past the allocated array.\n\n(fixed cur_idx when exactly one descriptor in the first fragment)"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:46.005Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95"
},
{
"url": "https://git.kernel.org/stable/c/79d95c02ae0a95e6e80e8e92b7ca74ecee02854f"
},
{
"url": "https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08"
}
],
"title": "firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64520",
"datePublished": "2026-07-25T09:14:46.005Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:46.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64519 (GCVE-0-2026-64519)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
NFSD: Fix infinite loop in layout state revocation
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix infinite loop in layout state revocation
find_one_sb_stid() skips stids whose sc_status is non-zero, but the
SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status
before calling nfsd4_close_layout(). The retry loop therefore finds
the same layout stid on every iteration, hanging the revoker
indefinitely.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1e33e1414bec54a4feafa9e67e2617031be0afe2 , < d1fc00ec02e9deb3f8d2bd59caf938c554fbc576
(git)
Affected: 1e33e1414bec54a4feafa9e67e2617031be0afe2 , < fe59ae27d7346245f5d8d97220f374e63efd28b5 (git) Affected: 1e33e1414bec54a4feafa9e67e2617031be0afe2 , < 44e5e4eb3a07bf3e1d931dd9f96f3edcfa376605 (git) Affected: 1e33e1414bec54a4feafa9e67e2617031be0afe2 , < 4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1fc00ec02e9deb3f8d2bd59caf938c554fbc576",
"status": "affected",
"version": "1e33e1414bec54a4feafa9e67e2617031be0afe2",
"versionType": "git"
},
{
"lessThan": "fe59ae27d7346245f5d8d97220f374e63efd28b5",
"status": "affected",
"version": "1e33e1414bec54a4feafa9e67e2617031be0afe2",
"versionType": "git"
},
{
"lessThan": "44e5e4eb3a07bf3e1d931dd9f96f3edcfa376605",
"status": "affected",
"version": "1e33e1414bec54a4feafa9e67e2617031be0afe2",
"versionType": "git"
},
{
"lessThan": "4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1",
"status": "affected",
"version": "1e33e1414bec54a4feafa9e67e2617031be0afe2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix infinite loop in layout state revocation\n\nfind_one_sb_stid() skips stids whose sc_status is non-zero, but the\nSC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status\nbefore calling nfsd4_close_layout(). The retry loop therefore finds\nthe same layout stid on every iteration, hanging the revoker\nindefinitely."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:45.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1fc00ec02e9deb3f8d2bd59caf938c554fbc576"
},
{
"url": "https://git.kernel.org/stable/c/fe59ae27d7346245f5d8d97220f374e63efd28b5"
},
{
"url": "https://git.kernel.org/stable/c/44e5e4eb3a07bf3e1d931dd9f96f3edcfa376605"
},
{
"url": "https://git.kernel.org/stable/c/4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1"
}
],
"title": "NFSD: Fix infinite loop in layout state revocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64519",
"datePublished": "2026-07-25T09:14:45.322Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:45.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64518 (GCVE-0-2026-64518)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
lockdep_sock_is_held() was added in tcp_ao_established_key()
by the cited commit.
It can be called from tcp_v[46]_timewait_ack() with twsk.
Since it does not have sk->sk_lock, the lockdep annotation
results in out-of-bound access.
$ pahole -C tcp_timewait_sock vmlinux | grep size
/* size: 288, cachelines: 5, members: 8 */
$ pahole -C sock vmlinux | grep sk_lock
socket_lock_t sk_lock; /* 440 192 */
Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
051f49d5176613dea88ecf73a101c3a99f4720e9 , < 87bb3e719042f0030a6dad39118c6a6b2a491ad9
(git)
Affected: 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 , < 510db031ba6eb40134f84c90ef963ea4b6dfb878 (git) Affected: 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 , < 29cf64d128c94cf98d1c69d8b2962d39db5ff4c6 (git) Affected: 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 , < 03cb001ef87b3f8d859cf7f96329acf3d6235d29 (git) Affected: 6.12.5 , < 6.12.92 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ao.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87bb3e719042f0030a6dad39118c6a6b2a491ad9",
"status": "affected",
"version": "051f49d5176613dea88ecf73a101c3a99f4720e9",
"versionType": "git"
},
{
"lessThan": "510db031ba6eb40134f84c90ef963ea4b6dfb878",
"status": "affected",
"version": "6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6",
"versionType": "git"
},
{
"lessThan": "29cf64d128c94cf98d1c69d8b2962d39db5ff4c6",
"status": "affected",
"version": "6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6",
"versionType": "git"
},
{
"lessThan": "03cb001ef87b3f8d859cf7f96329acf3d6235d29",
"status": "affected",
"version": "6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6",
"versionType": "git"
},
{
"lessThan": "6.12.92",
"status": "affected",
"version": "6.12.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ao.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().\n\nlockdep_sock_is_held() was added in tcp_ao_established_key()\nby the cited commit.\n\nIt can be called from tcp_v[46]_timewait_ack() with twsk.\n\nSince it does not have sk-\u003esk_lock, the lockdep annotation\nresults in out-of-bound access.\n\n $ pahole -C tcp_timewait_sock vmlinux | grep size\n \t/* size: 288, cachelines: 5, members: 8 */\n $ pahole -C sock vmlinux | grep sk_lock\n \tsocket_lock_t sk_lock; /* 440 192 */\n\nLet\u0027s not use lockdep_sock_is_held() for TCP_TIME_WAIT."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:44.603Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87bb3e719042f0030a6dad39118c6a6b2a491ad9"
},
{
"url": "https://git.kernel.org/stable/c/510db031ba6eb40134f84c90ef963ea4b6dfb878"
},
{
"url": "https://git.kernel.org/stable/c/29cf64d128c94cf98d1c69d8b2962d39db5ff4c6"
},
{
"url": "https://git.kernel.org/stable/c/03cb001ef87b3f8d859cf7f96329acf3d6235d29"
}
],
"title": "tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64518",
"datePublished": "2026-07-25T09:14:44.603Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:44.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64517 (GCVE-0-2026-64517)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
drm/xe/gsc: Fix double-free of managed BO in error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/gsc: Fix double-free of managed BO in error path
The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO
allocated with xe_managed_bo_create_pin_map() via
xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm
cleanup action registered, this causes a double-free when devm
unwinds during probe failure.
Remove the explicit free and let devm handle it, consistent with
all other xe_managed_bo_create_pin_map() callers.
(cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2e5d47fe7839298fa096970e184aac9bf82c3bd3 , < 7cb975fcd4777e7bad688f66aa0c10c16dd8276b
(git)
Affected: 2e5d47fe7839298fa096970e184aac9bf82c3bd3 , < 2c890e71ae26fa32f5a96c3694b71a2c310940e7 (git) Affected: 2e5d47fe7839298fa096970e184aac9bf82c3bd3 , < 889f70de2b51a877339e1979aab95111b41bed75 (git) Affected: 2e5d47fe7839298fa096970e184aac9bf82c3bd3 , < d3ded53fab90996e7d94a39049e11962dd066725 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_gsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7cb975fcd4777e7bad688f66aa0c10c16dd8276b",
"status": "affected",
"version": "2e5d47fe7839298fa096970e184aac9bf82c3bd3",
"versionType": "git"
},
{
"lessThan": "2c890e71ae26fa32f5a96c3694b71a2c310940e7",
"status": "affected",
"version": "2e5d47fe7839298fa096970e184aac9bf82c3bd3",
"versionType": "git"
},
{
"lessThan": "889f70de2b51a877339e1979aab95111b41bed75",
"status": "affected",
"version": "2e5d47fe7839298fa096970e184aac9bf82c3bd3",
"versionType": "git"
},
{
"lessThan": "d3ded53fab90996e7d94a39049e11962dd066725",
"status": "affected",
"version": "2e5d47fe7839298fa096970e184aac9bf82c3bd3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_gsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/gsc: Fix double-free of managed BO in error path\n\nThe error path in xe_gsc_init_post_hwconfig() explicitly frees a BO\nallocated with xe_managed_bo_create_pin_map() via\nxe_bo_unpin_map_no_vm(). Since the managed BO already has a devm\ncleanup action registered, this causes a double-free when devm\nunwinds during probe failure.\n\nRemove the explicit free and let devm handle it, consistent with\nall other xe_managed_bo_create_pin_map() callers.\n\n(cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:43.863Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7cb975fcd4777e7bad688f66aa0c10c16dd8276b"
},
{
"url": "https://git.kernel.org/stable/c/2c890e71ae26fa32f5a96c3694b71a2c310940e7"
},
{
"url": "https://git.kernel.org/stable/c/889f70de2b51a877339e1979aab95111b41bed75"
},
{
"url": "https://git.kernel.org/stable/c/d3ded53fab90996e7d94a39049e11962dd066725"
}
],
"title": "drm/xe/gsc: Fix double-free of managed BO in error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64517",
"datePublished": "2026-07-25T09:14:43.863Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:43.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64516 (GCVE-0-2026-64516)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
The VCPU BO contains the actual FW at an offset, but
it was not calculated into the VCPU BO size.
Subtract this from the FW size to make sure there is
no out of bounds access.
Make sure the stack and data offsets are aligned to
the 32K TLB size.
Check that the FW microcode actually fits in the
space that is reserved for it.
(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f , < ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4
(git)
Affected: d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f , < 3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3 (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4",
"status": "affected",
"version": "d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f",
"versionType": "git"
},
{
"lessThan": "3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3",
"status": "affected",
"version": "d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n\nThe VCPU BO contains the actual FW at an offset, but\nit was not calculated into the VCPU BO size.\nSubtract this from the FW size to make sure there is\nno out of bounds access.\n\nMake sure the stack and data offsets are aligned to\nthe 32K TLB size.\n\nCheck that the FW microcode actually fits in the\nspace that is reserved for it.\n\n(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:43.142Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4"
},
{
"url": "https://git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3"
}
],
"title": "drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64516",
"datePublished": "2026-07-25T09:14:43.142Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-25T09:14:43.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64515 (GCVE-0-2026-64515)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-07-25 09:14
VLAI
EPSS
VEX
Title
wifi: mac80211: fix MLE defragmentation
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix MLE defragmentation
If either reconf or EPCS multi-link element (MLE) is contained in
a non-transmitted profile, the defragmentation routine is called
with a pointer to the defragmented copy, but the original elements.
This is incorrect for two reasons:
- if the original defragmentation was needed, it will not find the
correct data
- if the original frame is at a higher address, the parsing will
potentially overrun the heap data (though given the layout of
the buffers, only into the new defragmentation buffer, and then
it has to stop and fail once that's filled with copied data.
Fix it by tracking the container along with the pointer and in
doing so also unify the two almost identical defragmentation
routines.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff , < 1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4
(git)
Affected: 4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff , < 55c479aae99b120489a432db9c717484e523dfd6 (git) Affected: 4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff , < 722b3f86df80644463d29fe5451e30a617f74500 (git) Affected: 4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff , < a74e893f30db64cdce0fc7a96d3baa417bcd55f5 (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/parse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4",
"status": "affected",
"version": "4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff",
"versionType": "git"
},
{
"lessThan": "55c479aae99b120489a432db9c717484e523dfd6",
"status": "affected",
"version": "4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff",
"versionType": "git"
},
{
"lessThan": "722b3f86df80644463d29fe5451e30a617f74500",
"status": "affected",
"version": "4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff",
"versionType": "git"
},
{
"lessThan": "a74e893f30db64cdce0fc7a96d3baa417bcd55f5",
"status": "affected",
"version": "4d70e9c5488dd57ff5fcabe4d4ecf3d9dd4555ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/parse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix MLE defragmentation\n\nIf either reconf or EPCS multi-link element (MLE) is contained in\na non-transmitted profile, the defragmentation routine is called\nwith a pointer to the defragmented copy, but the original elements.\n\nThis is incorrect for two reasons:\n - if the original defragmentation was needed, it will not find the\n correct data\n - if the original frame is at a higher address, the parsing will\n potentially overrun the heap data (though given the layout of\n the buffers, only into the new defragmentation buffer, and then\n it has to stop and fail once that\u0027s filled with copied data.\n\nFix it by tracking the container along with the pointer and in\ndoing so also unify the two almost identical defragmentation\nroutines."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T09:14:42.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4"
},
{
"url": "https://git.kernel.org/stable/c/55c479aae99b120489a432db9c717484e523dfd6"
},
{
"url": "https://git.kernel.org/stable/c/722b3f86df80644463d29fe5451e30a617f74500"
},
{
"url": "https://git.kernel.org/stable/c/a74e893f30db64cdce0fc7a96d3baa417bcd55f5"
}
],
"title": "wifi: mac80211: fix MLE defragmentation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64515",
"datePublished": "2026-07-25T09:14:42.418Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T09:14:42.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64514 (GCVE-0-2026-64514)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
userfaultfd: gate must_wait writability check on pte_present()
Summary
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: gate must_wait writability check on pte_present()
userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE
without taking the page table lock and then apply pte_write() /
huge_pte_write() to it. Those accessors decode bits from the present
encoding only; on a swap or migration entry they read the offset bits that
happen to share the same position and return an undefined result.
The intent of the check is "is this fault still WP-blocked?". A
non-marker swap entry means the page is in transit -- the userfault
context the original fault delivered against is no longer the same, and
the swap-in or migration completion path will re-deliver a fresh fault if
userspace still needs to handle it. Worst case under the current code the
garbage write bit says "wait", and the thread stays asleep until a
UFFDIO_WAKE that may never arrive.
Gate the writability check on pte_present() so the lockless re-check only
inspects present-PTE bits when the entry is actually present. The
non-present, non-marker case returns "don't wait" and lets the fault path
retry.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
369cd2121be440543280b91056de187f625d0dbb , < a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f
(git)
Affected: 369cd2121be440543280b91056de187f625d0dbb , < d4026417e8184d13850a0bad4d96ceb6ed9f7152 (git) Affected: 369cd2121be440543280b91056de187f625d0dbb , < 29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0 (git) Affected: 369cd2121be440543280b91056de187f625d0dbb , < 5f4dbdb0a87596214076b20b94f2b71b522170b3 (git) Affected: 369cd2121be440543280b91056de187f625d0dbb , < a6e9a4939e359599701b1da351e84f72e021443a (git) Affected: 369cd2121be440543280b91056de187f625d0dbb , < 60d696a037eeeedfb57756dfe7ec08a1587c8631 (git) Affected: 369cd2121be440543280b91056de187f625d0dbb , < 710183888174639a15fcec16cd1af766b8480bb7 (git) Affected: 369cd2121be440543280b91056de187f625d0dbb , < 8e80af52db652fbc41320eee45a4f73bc029faf2 (git) |
|
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/userfaultfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "d4026417e8184d13850a0bad4d96ceb6ed9f7152",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "5f4dbdb0a87596214076b20b94f2b71b522170b3",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "a6e9a4939e359599701b1da351e84f72e021443a",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "60d696a037eeeedfb57756dfe7ec08a1587c8631",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "710183888174639a15fcec16cd1af766b8480bb7",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
},
{
"lessThan": "8e80af52db652fbc41320eee45a4f73bc029faf2",
"status": "affected",
"version": "369cd2121be440543280b91056de187f625d0dbb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/userfaultfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: gate must_wait writability check on pte_present()\n\nuserfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE\nwithout taking the page table lock and then apply pte_write() /\nhuge_pte_write() to it. Those accessors decode bits from the present\nencoding only; on a swap or migration entry they read the offset bits that\nhappen to share the same position and return an undefined result.\n\nThe intent of the check is \"is this fault still WP-blocked?\". A\nnon-marker swap entry means the page is in transit -- the userfault\ncontext the original fault delivered against is no longer the same, and\nthe swap-in or migration completion path will re-deliver a fresh fault if\nuserspace still needs to handle it. Worst case under the current code the\ngarbage write bit says \"wait\", and the thread stays asleep until a\nUFFDIO_WAKE that may never arrive.\n\nGate the writability check on pte_present() so the lockless re-check only\ninspects present-PTE bits when the entry is actually present. The\nnon-present, non-marker case returns \"don\u0027t wait\" and lets the fault path\nretry."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:05.878Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f"
},
{
"url": "https://git.kernel.org/stable/c/d4026417e8184d13850a0bad4d96ceb6ed9f7152"
},
{
"url": "https://git.kernel.org/stable/c/29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0"
},
{
"url": "https://git.kernel.org/stable/c/5f4dbdb0a87596214076b20b94f2b71b522170b3"
},
{
"url": "https://git.kernel.org/stable/c/a6e9a4939e359599701b1da351e84f72e021443a"
},
{
"url": "https://git.kernel.org/stable/c/60d696a037eeeedfb57756dfe7ec08a1587c8631"
},
{
"url": "https://git.kernel.org/stable/c/710183888174639a15fcec16cd1af766b8480bb7"
},
{
"url": "https://git.kernel.org/stable/c/8e80af52db652fbc41320eee45a4f73bc029faf2"
}
],
"title": "userfaultfd: gate must_wait writability check on pte_present()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64514",
"datePublished": "2026-07-25T08:52:05.878Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:05.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64513 (GCVE-0-2026-64513)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
KVM: x86: Unconditionally recompute CR8 intercept on PPR update
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Unconditionally recompute CR8 intercept on PPR update
The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits
when the guest's virtual TPR falls under the specified threshold,
allowing KVM to inject previously masked interrupts.
KVM handles these VM exits in handle_tpr_below_threshold().
Commit eb90f3417a0c ("KVM: vmx: speed up TPR below threshold vmexits")
optimized this function by calling apic_update_ppr() instead of raising
KVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is
a pending, deliverable interrupt.
However, if there are no new interrupts pending, apic_update_ppr() does
not issue the request. Thus, kvm_lapic_update_cr8_intercept() and
vmx_update_cr8_intercept() are not called before VM entry, which results
in a high, stale TPR_THRESHOLD. This is problematic due to the following
sentence in 28.2.1.1 "VM-Execution Control Fields" in the SDM:
The following check is performed if the “use TPR shadow” VM-execution
control is 1 and the “virtualize APIC accesses” and “virtual-interrupt
delivery” VM-execution controls are both 0: the value of bits 3:0 of
the TPR threshold VM-execution control field should not be greater
than the value of bits 7:4 of VTPR.
This error condition is typically not observed when KVM runs on a bare
metal system because modern processors support APICv, which enables
virtual-interrupt delivery, and which KVM uses when possible. This
causes the processor to no longer generate TPR-below-threshold exits
and to no longer check TPR_THRESHOLD on entry. However, when running
on older platforms, or under nested virtualization on a hypervisor that
does not support virtual-interrupt delivery and enforces this check
(like Hyper-V) this can cause a VM entry failure with hardware error
0x7, as seen in [1].
Call kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not
find a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).
Remove calls to kvm_lapic_update_cr8_intercept() on paths that end up in
apic_update_ppr(), as they now become redundant. This ensures that any
path that updates the guest's PPR also figures out if KVM needs to wait
for a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM).
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eb90f3417a0cc4880e979ccc84e41890d410ea5b , < ff9c4c6428883182960cfe5c78928f0896d80ebc
(git)
Affected: eb90f3417a0cc4880e979ccc84e41890d410ea5b , < 8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df (git) Affected: eb90f3417a0cc4880e979ccc84e41890d410ea5b , < bb365a506b1e6fb050c0fceaad354fe395385ef0 (git) |
|
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff9c4c6428883182960cfe5c78928f0896d80ebc",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "bb365a506b1e6fb050c0fceaad354fe395385ef0",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Unconditionally recompute CR8 intercept on PPR update\n\nThe TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits\nwhen the guest\u0027s virtual TPR falls under the specified threshold,\nallowing KVM to inject previously masked interrupts.\n\nKVM handles these VM exits in handle_tpr_below_threshold().\nCommit eb90f3417a0c (\"KVM: vmx: speed up TPR below threshold vmexits\")\noptimized this function by calling apic_update_ppr() instead of raising\nKVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is\na pending, deliverable interrupt.\n\nHowever, if there are no new interrupts pending, apic_update_ppr() does\nnot issue the request. Thus, kvm_lapic_update_cr8_intercept() and\nvmx_update_cr8_intercept() are not called before VM entry, which results\nin a high, stale TPR_THRESHOLD. This is problematic due to the following\nsentence in 28.2.1.1 \"VM-Execution Control Fields\" in the SDM:\n\n The following check is performed if the \u201cuse TPR shadow\u201d VM-execution\n control is 1 and the \u201cvirtualize APIC accesses\u201d and \u201cvirtual-interrupt\n delivery\u201d VM-execution controls are both 0: the value of bits 3:0 of\n the TPR threshold VM-execution control field should not be greater\n than the value of bits 7:4 of VTPR.\n\nThis error condition is typically not observed when KVM runs on a bare\nmetal system because modern processors support APICv, which enables\nvirtual-interrupt delivery, and which KVM uses when possible. This\ncauses the processor to no longer generate TPR-below-threshold exits\nand to no longer check TPR_THRESHOLD on entry. However, when running\non older platforms, or under nested virtualization on a hypervisor that\ndoes not support virtual-interrupt delivery and enforces this check\n(like Hyper-V) this can cause a VM entry failure with hardware error\n0x7, as seen in [1].\n\nCall kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not\nfind a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).\nRemove calls to kvm_lapic_update_cr8_intercept() on paths that end up in\napic_update_ppr(), as they now become redundant. This ensures that any\npath that updates the guest\u0027s PPR also figures out if KVM needs to wait\nfor a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM)."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:05.119Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff9c4c6428883182960cfe5c78928f0896d80ebc"
},
{
"url": "https://git.kernel.org/stable/c/8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df"
},
{
"url": "https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"
}
],
"title": "KVM: x86: Unconditionally recompute CR8 intercept on PPR update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64513",
"datePublished": "2026-07-25T08:52:05.119Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:05.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64512 (GCVE-0-2026-64512)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
The definition of reg->access_width changes depending on the
reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses
access_width to indicate the PCC region, which can result in a UBSAN
if the value is greater than 4.
For example:
UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9
shift exponent 32 is too large for 32-bit type 'int'
CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)
Hardware name: To be filled by O.E.M.
Call trace:
...(trimming)
ubsan_epilogue+0x10/0x48
__ubsan_handle_shift_out_of_bounds+0xdc/0x1e0
cpc_write+0x4d0/0x670
cppc_set_perf+0x18c/0x490
cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]
... (trimming)
Lets fix this by validating the region type, as well as whether
access_width has a value. Then since we are returning bit_width
directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting
the size.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4949affd5288b867cdf115f5b08d6166b2027f87 , < b54c4632946ae42f2b39ed38abd909bbf78cbcc2
(git)
Affected: 01fc53be672acae37e611c80cc0b4f3939584de3 , < e904596ba6dd108534ffa15e3e46b2fe245145e2 (git) Affected: 1b890ae474d19800a6be1696df7fb4d9a41676e4 , < 2fb80e962029000959f651665baa4838cc92eb99 (git) Affected: 2f4a4d63a193be6fd530d180bb13c3592052904c , < 37f28bf8f14672dfa395994e41fd778a63f0bf5c (git) Affected: 2f4a4d63a193be6fd530d180bb13c3592052904c , < f29dc6132d4968e39d8fa575d1a12e2c718ce57b (git) Affected: 2f4a4d63a193be6fd530d180bb13c3592052904c , < dc066bd13c860bb27d6ace511210e18b8064c1d9 (git) Affected: 2f4a4d63a193be6fd530d180bb13c3592052904c , < 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 (git) Affected: 6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1 (git) Affected: 5.15.154 , < 5.15.155 (semver) Affected: 6.1.90 , < 6.1.178 (semver) Affected: 6.6.30 , < 6.6.145 (semver) Affected: 6.8.9 , < 6.9 (semver) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 5.15.155 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/cppc_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b54c4632946ae42f2b39ed38abd909bbf78cbcc2",
"status": "affected",
"version": "4949affd5288b867cdf115f5b08d6166b2027f87",
"versionType": "git"
},
{
"lessThan": "e904596ba6dd108534ffa15e3e46b2fe245145e2",
"status": "affected",
"version": "01fc53be672acae37e611c80cc0b4f3939584de3",
"versionType": "git"
},
{
"lessThan": "2fb80e962029000959f651665baa4838cc92eb99",
"status": "affected",
"version": "1b890ae474d19800a6be1696df7fb4d9a41676e4",
"versionType": "git"
},
{
"lessThan": "37f28bf8f14672dfa395994e41fd778a63f0bf5c",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"lessThan": "f29dc6132d4968e39d8fa575d1a12e2c718ce57b",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"lessThan": "dc066bd13c860bb27d6ace511210e18b8064c1d9",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"lessThan": "1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"status": "affected",
"version": "6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1",
"versionType": "git"
},
{
"lessThan": "5.15.155",
"status": "affected",
"version": "5.15.154",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.90",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.30",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/cppc_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.155",
"versionStartIncluding": "5.15.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Suppress UBSAN warning caused by field misuse\n\nThe definition of reg-\u003eaccess_width changes depending on the\nreg-\u003espace_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses\naccess_width to indicate the PCC region, which can result in a UBSAN\nif the value is greater than 4.\n\nFor example:\n\n UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9\n shift exponent 32 is too large for 32-bit type \u0027int\u0027\n CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)\n Hardware name: To be filled by O.E.M.\n Call trace:\n ...(trimming)\n ubsan_epilogue+0x10/0x48\n __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0\n cpc_write+0x4d0/0x670\n cppc_set_perf+0x18c/0x490\n cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]\n ... (trimming)\n\nLets fix this by validating the region type, as well as whether\naccess_width has a value. Then since we are returning bit_width\ndirectly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting\nthe size."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:04.423Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b54c4632946ae42f2b39ed38abd909bbf78cbcc2"
},
{
"url": "https://git.kernel.org/stable/c/e904596ba6dd108534ffa15e3e46b2fe245145e2"
},
{
"url": "https://git.kernel.org/stable/c/2fb80e962029000959f651665baa4838cc92eb99"
},
{
"url": "https://git.kernel.org/stable/c/37f28bf8f14672dfa395994e41fd778a63f0bf5c"
},
{
"url": "https://git.kernel.org/stable/c/f29dc6132d4968e39d8fa575d1a12e2c718ce57b"
},
{
"url": "https://git.kernel.org/stable/c/dc066bd13c860bb27d6ace511210e18b8064c1d9"
},
{
"url": "https://git.kernel.org/stable/c/1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1"
}
],
"title": "ACPI: CPPC: Suppress UBSAN warning caused by field misuse",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64512",
"datePublished": "2026-07-25T08:52:04.423Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:04.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64511 (GCVE-0-2026-64511)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
ACPI: NFIT: core: Fix possible NULL pointer dereference
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: NFIT: core: Fix possible NULL pointer dereference
After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before
getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler
for the NFIT device before checking the presence of the NFIT table. If
that table is not there, 0 is returned without allocating the acpi_desc
object and setting the driver data pointer of the NFIT device. If the
platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification
on the NFIT device at that point, acpi_nfit_uc_error_notify() will
dereference a NULL pointer.
Prevent that from occurring by adding an acpi_desc check against NULL
to acpi_nfit_uc_error_notify().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9b311b7313d6c104dd4a2d43ab54536dce07f960 , < a44343fe230aa48c74ef09830f3c5c90848b257e
(git)
Affected: 9b311b7313d6c104dd4a2d43ab54536dce07f960 , < 3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6 (git) Affected: 9b311b7313d6c104dd4a2d43ab54536dce07f960 , < 452945662fd8e9862a2d2043239c7ee1815d1ac4 (git) Affected: 9b311b7313d6c104dd4a2d43ab54536dce07f960 , < 873576e585da5d0fc5debbab74eed565c0acea99 (git) Affected: 9b311b7313d6c104dd4a2d43ab54536dce07f960 , < 027e128abb82788189d6d45b68e3e8e7329b67be (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/nfit/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a44343fe230aa48c74ef09830f3c5c90848b257e",
"status": "affected",
"version": "9b311b7313d6c104dd4a2d43ab54536dce07f960",
"versionType": "git"
},
{
"lessThan": "3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6",
"status": "affected",
"version": "9b311b7313d6c104dd4a2d43ab54536dce07f960",
"versionType": "git"
},
{
"lessThan": "452945662fd8e9862a2d2043239c7ee1815d1ac4",
"status": "affected",
"version": "9b311b7313d6c104dd4a2d43ab54536dce07f960",
"versionType": "git"
},
{
"lessThan": "873576e585da5d0fc5debbab74eed565c0acea99",
"status": "affected",
"version": "9b311b7313d6c104dd4a2d43ab54536dce07f960",
"versionType": "git"
},
{
"lessThan": "027e128abb82788189d6d45b68e3e8e7329b67be",
"status": "affected",
"version": "9b311b7313d6c104dd4a2d43ab54536dce07f960",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/nfit/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix possible NULL pointer dereference\n\nAfter commit 9b311b7313d6 (\"ACPI: NFIT: Install Notify() handler before\ngetting NFIT table\"), acpi_nfit_probe() installs an ACPI notify handler\nfor the NFIT device before checking the presence of the NFIT table. If\nthat table is not there, 0 is returned without allocating the acpi_desc\nobject and setting the driver data pointer of the NFIT device. If the\nplatform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification\non the NFIT device at that point, acpi_nfit_uc_error_notify() will\ndereference a NULL pointer.\n\nPrevent that from occurring by adding an acpi_desc check against NULL\nto acpi_nfit_uc_error_notify()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:03.818Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e"
},
{
"url": "https://git.kernel.org/stable/c/3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6"
},
{
"url": "https://git.kernel.org/stable/c/452945662fd8e9862a2d2043239c7ee1815d1ac4"
},
{
"url": "https://git.kernel.org/stable/c/873576e585da5d0fc5debbab74eed565c0acea99"
},
{
"url": "https://git.kernel.org/stable/c/027e128abb82788189d6d45b68e3e8e7329b67be"
}
],
"title": "ACPI: NFIT: core: Fix possible NULL pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64511",
"datePublished": "2026-07-25T08:52:03.818Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:03.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64510 (GCVE-0-2026-64510)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
If acpi_nfit_init() fails after adding the acpi_desc object to the
acpi_descs list, that object is never removed from that list because
the acpi_nfit_shutdown() devm action is not added for the NFIT device
in that case. Next, the acpi_nfit_init() failure causes
acpi_nfit_probe() to fail, the acpi_desc object is freed, and a
dangling pointer is left behind in the acpi_descs. Any subsequent
ACPI Machine Check Exception will trigger nfit_handle_mce() which
iterates over acpi_descs and so a use-after-free will occur.
Moreover, if acpi_nfit_probe() returns 0 after installing a notify
handler for the NFIT device and without allocating the acpi_desc
object and setting the NFIT device's driver data pointer, the
acpi_desc object will be allocated by acpi_nfit_update_notify()
and acpi_nfit_init() will be called to initialize it. Regardless
of whether or not acpi_nfit_init() fails in that case, the
acpi_nfit_shutdown() devm action is not added for the NFIT device
and acpi_desc is never removed from the acpi_descs list. If the
acpi_desc object is freed subsequently on driver removal, any
subsequent ACPI MCE will lead to a use-after-free like in the
previous case.
To address the first issue mentioned above, make acpi_nfit_probe()
call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and
to address the other one, add a remove callback to the driver and
make it call acpi_nfit_shutdown(). Also, since it is now possible to
pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it
may not have been initialized, add checks against NULL for acpi_desc and
its nvdimm_bus field to that function and make acpi_nfit_unregister()
clear the latter after unregistering the NVDIMM bus.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a61fe6f7902ecaa89d5e6c709490fc4324927134 , < ee82078e776ae31266cc70fdf62ac17c3c6f100a
(git)
Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < 6ff054cc02a763914773b026cacb429e5fbf64fa (git) Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4 (git) Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < c127dbd832bd4b9aef8a749d9f491b74042f9b47 (git) Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < df7c92216a1583a76cb0cbf2f21cd68870609b05 (git) Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < 3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa (git) Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < 7d69235bdc581a4346e9bcd6a8bea37d3e1abd25 (git) Affected: a61fe6f7902ecaa89d5e6c709490fc4324927134 , < 38bf27511ef41bffebd157ec3eba41fc89ba59cd (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/nfit/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee82078e776ae31266cc70fdf62ac17c3c6f100a",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "6ff054cc02a763914773b026cacb429e5fbf64fa",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "c127dbd832bd4b9aef8a749d9f491b74042f9b47",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "df7c92216a1583a76cb0cbf2f21cd68870609b05",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "7d69235bdc581a4346e9bcd6a8bea37d3e1abd25",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "38bf27511ef41bffebd157ec3eba41fc89ba59cd",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/nfit/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix acpi_nfit_init() error cleanup\n\nIf acpi_nfit_init() fails after adding the acpi_desc object to the\nacpi_descs list, that object is never removed from that list because\nthe acpi_nfit_shutdown() devm action is not added for the NFIT device\nin that case. Next, the acpi_nfit_init() failure causes\nacpi_nfit_probe() to fail, the acpi_desc object is freed, and a\ndangling pointer is left behind in the acpi_descs. Any subsequent\nACPI Machine Check Exception will trigger nfit_handle_mce() which\niterates over acpi_descs and so a use-after-free will occur.\n\nMoreover, if acpi_nfit_probe() returns 0 after installing a notify\nhandler for the NFIT device and without allocating the acpi_desc\nobject and setting the NFIT device\u0027s driver data pointer, the\nacpi_desc object will be allocated by acpi_nfit_update_notify()\nand acpi_nfit_init() will be called to initialize it. Regardless\nof whether or not acpi_nfit_init() fails in that case, the\nacpi_nfit_shutdown() devm action is not added for the NFIT device\nand acpi_desc is never removed from the acpi_descs list. If the\nacpi_desc object is freed subsequently on driver removal, any\nsubsequent ACPI MCE will lead to a use-after-free like in the\nprevious case.\n\nTo address the first issue mentioned above, make acpi_nfit_probe()\ncall acpi_nfit_shutdown() directly on acpi_nfit_init() failures and\nto address the other one, add a remove callback to the driver and\nmake it call acpi_nfit_shutdown(). Also, since it is now possible to\npass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it\nmay not have been initialized, add checks against NULL for acpi_desc and\nits nvdimm_bus field to that function and make acpi_nfit_unregister()\nclear the latter after unregistering the NVDIMM bus."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:03.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a"
},
{
"url": "https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa"
},
{
"url": "https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4"
},
{
"url": "https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47"
},
{
"url": "https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05"
},
{
"url": "https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa"
},
{
"url": "https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25"
},
{
"url": "https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd"
}
],
"title": "ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64510",
"datePublished": "2026-07-25T08:52:03.208Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:03.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64509 (GCVE-0-2026-64509)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
rust: block: fix GenDisk cleanup paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
rust: block: fix GenDisk cleanup paths
GenDiskBuilder::build() still has fallible work after
__blk_mq_alloc_disk(), but its error path only recovers the
foreign queue data. That leaks the temporary gendisk and
request_queue until later teardown. If the caller moved the last
Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq
state after the tag set is dropped.
Fix the pre-registration failure path by dropping the temporary
gendisk reference with put_disk() before recovering queue_data,
so disk_release() can tear down the owned queue.
Also pair GenDisk::drop() with put_disk() after del_gendisk().
Once a Rust GenDisk has been added with device_add_disk(),
del_gendisk() only unregisters it; the final gendisk reference
still has to be dropped to complete the release path.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3253aba3408aa4eb2e4e09365eede3e63ef7536b , < d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb
(git)
Affected: 3253aba3408aa4eb2e4e09365eede3e63ef7536b , < e7636f26f77070a529c26d65afd217514ce85ce4 (git) Affected: 3253aba3408aa4eb2e4e09365eede3e63ef7536b , < 6822a2685b4da9a87efd1fce4b042678a31ff734 (git) Affected: 3253aba3408aa4eb2e4e09365eede3e63ef7536b , < 2957771379fa335103a4b539db57bb2271e12142 (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"rust/kernel/block/mq/gen_disk.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
},
{
"lessThan": "e7636f26f77070a529c26d65afd217514ce85ce4",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
},
{
"lessThan": "6822a2685b4da9a87efd1fce4b042678a31ff734",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
},
{
"lessThan": "2957771379fa335103a4b539db57bb2271e12142",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"rust/kernel/block/mq/gen_disk.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust: block: fix GenDisk cleanup paths\n\nGenDiskBuilder::build() still has fallible work after\n__blk_mq_alloc_disk(), but its error path only recovers the\nforeign queue data. That leaks the temporary gendisk and\nrequest_queue until later teardown. If the caller moved the last\nArc\u003cTagSet\u003cT\u003e\u003e into build(), the leaked queue can retain blk-mq\nstate after the tag set is dropped.\n\nFix the pre-registration failure path by dropping the temporary\ngendisk reference with put_disk() before recovering queue_data,\nso disk_release() can tear down the owned queue.\n\nAlso pair GenDisk::drop() with put_disk() after del_gendisk().\nOnce a Rust GenDisk has been added with device_add_disk(),\ndel_gendisk() only unregisters it; the final gendisk reference\nstill has to be dropped to complete the release path."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:02.486Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb"
},
{
"url": "https://git.kernel.org/stable/c/e7636f26f77070a529c26d65afd217514ce85ce4"
},
{
"url": "https://git.kernel.org/stable/c/6822a2685b4da9a87efd1fce4b042678a31ff734"
},
{
"url": "https://git.kernel.org/stable/c/2957771379fa335103a4b539db57bb2271e12142"
}
],
"title": "rust: block: fix GenDisk cleanup paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64509",
"datePublished": "2026-07-25T08:52:02.486Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:02.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64508 (GCVE-0-2026-64508)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
bpf: Support for hardening against JIT spraying
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Support for hardening against JIT spraying
The BPF JIT allocator packs many small programs into larger executable
allocations and reuses space within those allocations as programs are
loaded and freed. When fresh code is written into space that a previous
program occupied, an indirect jump into the new program can reuse a branch
prediction left behind by the old one.
Flush the indirect branch predictors before reusing JIT memory so that
indirect jumps into a newly written program don't reuse predictions from an
old program that occupied the same space.
Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush
static call for flushing the branch predictors on JIT memory reuse.
Architectures that need a flush, can update it to a predictor flush
function. By default, its a NOP and does not emit any CALL.
Allocations larger than a pack are not covered by this flush. That is safe
because cBPF programs (the unprivileged attack surface) are bounded well
below a pack size. Issue a warning if this assumption is ever violated
while the flush is active.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e52c240c43a601b681e3a4e58fc5685114d4726
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < eed774da601268dae674e14d54a15e3624691f52 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8ff183ee4d8c452960df58175a094828c0513b2e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7a6c171c6a1ac6d1509752dac131d941a3de0b37 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 96cce16e26dd02a8678f1e87f88a4b5cdb63b995 (git) Affected: 0 , < 6.6.145 (semver) Affected: 0 , < 6.12.97 (semver) Affected: 0 , < 6.18.39 (semver) Affected: 0 , < 7.1.4 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.145 , ≤ 6.6.*
(semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/filter.h",
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e52c240c43a601b681e3a4e58fc5685114d4726",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eed774da601268dae674e14d54a15e3624691f52",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8ff183ee4d8c452960df58175a094828c0513b2e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7a6c171c6a1ac6d1509752dac131d941a3de0b37",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "96cce16e26dd02a8678f1e87f88a4b5cdb63b995",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.39",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/filter.h",
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don\u0027t reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:01.732Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726"
},
{
"url": "https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52"
},
{
"url": "https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e"
},
{
"url": "https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37"
},
{
"url": "https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995"
}
],
"title": "bpf: Support for hardening against JIT spraying",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64508",
"datePublished": "2026-07-25T08:52:01.732Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:01.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64507 (GCVE-0-2026-64507)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
x86/bugs: Enable IBPB flush on BPF JIT allocation
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Enable IBPB flush on BPF JIT allocation
Enable hardening against JIT spraying when Spectre-v2 mitigations are in
use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip
enabling the IBPB flush if the BPF dispatcher is already using a retpoline
sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling
under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cb27f3bf915cc0f20fc0c48da9059304e39ebd35
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9354248fc1c33a844ca1872761f6668b393e8c37 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 52440e15d9628f8f239373c0f2e5e8f92feea2df (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a3af84b0fa00ead01fcd0e28b5d773ff25990a0d (git) Affected: 0 , < 6.6.145 (semver) Affected: 0 , < 6.12.97 (semver) Affected: 0 , < 6.18.39 (semver) Affected: 0 , < 7.1.4 (semver) |
|
| Linux | Linux |
Unaffected:
6.6.145 , ≤ 6.6.*
(semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb27f3bf915cc0f20fc0c48da9059304e39ebd35",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9354248fc1c33a844ca1872761f6668b393e8c37",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "52440e15d9628f8f239373c0f2e5e8f92feea2df",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a3af84b0fa00ead01fcd0e28b5d773ff25990a0d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.39",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:01.008Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35"
},
{
"url": "https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37"
},
{
"url": "https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1"
},
{
"url": "https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df"
},
{
"url": "https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d"
}
],
"title": "x86/bugs: Enable IBPB flush on BPF JIT allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64507",
"datePublished": "2026-07-25T08:52:01.008Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:01.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64506 (GCVE-0-2026-64506)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:52 – Updated: 2026-07-25 08:52
VLAI
EPSS
VEX
Title
wifi: rtw89: correct drop logic for malformed AMPDU frames
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: correct drop logic for malformed AMPDU frames
The previous commit aims to fix issue caused by malformed AMPDU frames.
But the drop logic fails to deal with the first AMPDU packet paired with
certain range of sequence number, and leads to unexpected packet drop.
It is more likely to encounter this failure when there are busy traffic
during rekey process and could lead to disconnection from the AP.
Fix this by adding a initial state judgement and only reset status
during pairwise rekey.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1 , < 994994cfadaf1fd362dea9b8d9d633f85dc1b3c3
(git)
Affected: bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1 , < 63ccdfac8677387dfdbd9d4336089e9823280704 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/core.c",
"drivers/net/wireless/realtek/rtw89/mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "994994cfadaf1fd362dea9b8d9d633f85dc1b3c3",
"status": "affected",
"version": "bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1",
"versionType": "git"
},
{
"lessThan": "63ccdfac8677387dfdbd9d4336089e9823280704",
"status": "affected",
"version": "bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/core.c",
"drivers/net/wireless/realtek/rtw89/mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: correct drop logic for malformed AMPDU frames\n\nThe previous commit aims to fix issue caused by malformed AMPDU frames.\nBut the drop logic fails to deal with the first AMPDU packet paired with\ncertain range of sequence number, and leads to unexpected packet drop.\nIt is more likely to encounter this failure when there are busy traffic\nduring rekey process and could lead to disconnection from the AP.\nFix this by adding a initial state judgement and only reset status\nduring pairwise rekey."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:52:00.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/994994cfadaf1fd362dea9b8d9d633f85dc1b3c3"
},
{
"url": "https://git.kernel.org/stable/c/63ccdfac8677387dfdbd9d4336089e9823280704"
}
],
"title": "wifi: rtw89: correct drop logic for malformed AMPDU frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64506",
"datePublished": "2026-07-25T08:52:00.322Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:52:00.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64505 (GCVE-0-2026-64505)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
usb: gadget: function: rndis: add length check for header
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: function: rndis: add length check for header
Add a length check for the rndis header in rndis_rm_hdr, to ensure that
MessageType, MessageLength, DataOffset, and DataLength fields are
present before they are accessed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 200dd5092296ad4d5ae47f8445a2fb1edd1da973
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9ffd567d7bf269824dfac06f8ab9a32fef72699b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b73c0142e3acdc063b50c33afb7be19cdb2cd410 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ba2cc601e59fe68716646199a33303493513e2e3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7515a6d4a9e9e4838b833825882efa00e85f8901 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9facd79028a7807879eb441d12f0e00720980aa3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 21b5bf155435008e0fb0736795289788e63d426f (git) Affected: 0 , < 5.10.261 (semver) Affected: 0 , < 5.15.212 (semver) Affected: 0 , < 6.1.178 (semver) Affected: 0 , < 6.6.145 (semver) Affected: 0 , < 6.12.96 (semver) Affected: 0 , < 6.18.39 (semver) Affected: 0 , < 7.1.4 (semver) |
|
| Linux | Linux |
Unaffected:
5.10.261 , ≤ 5.10.*
(semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/rndis.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "200dd5092296ad4d5ae47f8445a2fb1edd1da973",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9ffd567d7bf269824dfac06f8ab9a32fef72699b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b73c0142e3acdc063b50c33afb7be19cdb2cd410",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ba2cc601e59fe68716646199a33303493513e2e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7515a6d4a9e9e4838b833825882efa00e85f8901",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9facd79028a7807879eb441d12f0e00720980aa3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "21b5bf155435008e0fb0736795289788e63d426f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.39",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/rndis.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: function: rndis: add length check for header\n\nAdd a length check for the rndis header in rndis_rm_hdr, to ensure that\nMessageType, MessageLength, DataOffset, and DataLength fields are\npresent before they are accessed."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:59.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/200dd5092296ad4d5ae47f8445a2fb1edd1da973"
},
{
"url": "https://git.kernel.org/stable/c/9ffd567d7bf269824dfac06f8ab9a32fef72699b"
},
{
"url": "https://git.kernel.org/stable/c/b73c0142e3acdc063b50c33afb7be19cdb2cd410"
},
{
"url": "https://git.kernel.org/stable/c/d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433"
},
{
"url": "https://git.kernel.org/stable/c/ba2cc601e59fe68716646199a33303493513e2e3"
},
{
"url": "https://git.kernel.org/stable/c/7515a6d4a9e9e4838b833825882efa00e85f8901"
},
{
"url": "https://git.kernel.org/stable/c/9facd79028a7807879eb441d12f0e00720980aa3"
},
{
"url": "https://git.kernel.org/stable/c/21b5bf155435008e0fb0736795289788e63d426f"
}
],
"title": "usb: gadget: function: rndis: add length check for header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64505",
"datePublished": "2026-07-25T08:51:59.618Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:59.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64504 (GCVE-0-2026-64504)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: accel: bmc150: clamp the device-reported FIFO frame count
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: bmc150: clamp the device-reported FIFO frame count
__bmc150_accel_fifo_flush() copies the number of samples the device
reports in its hardware FIFO into an on-stack buffer
u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];
which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The
frame count is read from the FIFO_STATUS register and only masked to its
7 valid bits:
count = val & 0x7F;
so it can be 0..127. The only other limit applied to it is the optional
caller-supplied sample budget:
if (samples && count > samples)
count = samples;
which does not constrain count on the flush-all path (samples == 0), and
leaves it well above 32 whenever samples is larger. count samples are
then transferred into buffer[]:
bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a
malfunctioning, malicious or counterfeit accelerometer (or an attacker
tampering with the I2C/SPI bus) that reports up to 127 frames writes up
to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up
to 570 bytes that clobbers the stack canary, saved registers and the
return address.
Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]
is sized for, before the transfer, mirroring the watermark clamp already
done in bmc150_accel_set_watermark(). A well-formed flush reports at most
BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3bbec9773389112330954a6a64422eaa78d546c1 , < b5a9f521e0a49a0266200fd535b32a9668ecb33b
(git)
Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < 2fe0531dd73eff1de0f2584cb77716d645e548d5 (git) Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff (git) Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc (git) Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < 89f4a4ca0ac3a933c750569a771c079a290b0721 (git) Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < 3e766526827acd542bcd36c20c4d5f397e0f6521 (git) Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < 35a3cd8fd65e15029eb90f1e510045b1bb071175 (git) Affected: 3bbec9773389112330954a6a64422eaa78d546c1 , < ce0e1cae26096fe959a0da5563a6d6d5a801d5fb (git) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/bmc150-accel-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5a9f521e0a49a0266200fd535b32a9668ecb33b",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "2fe0531dd73eff1de0f2584cb77716d645e548d5",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "89f4a4ca0ac3a933c750569a771c079a290b0721",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "3e766526827acd542bcd36c20c4d5f397e0f6521",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "35a3cd8fd65e15029eb90f1e510045b1bb071175",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
},
{
"lessThan": "ce0e1cae26096fe959a0da5563a6d6d5a801d5fb",
"status": "affected",
"version": "3bbec9773389112330954a6a64422eaa78d546c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/bmc150-accel-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: bmc150: clamp the device-reported FIFO frame count\n\n__bmc150_accel_fifo_flush() copies the number of samples the device\nreports in its hardware FIFO into an on-stack buffer\n\n\tu16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];\n\nwhich is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The\nframe count is read from the FIFO_STATUS register and only masked to its\n7 valid bits:\n\n\tcount = val \u0026 0x7F;\n\nso it can be 0..127. The only other limit applied to it is the optional\ncaller-supplied sample budget:\n\n\tif (samples \u0026\u0026 count \u003e samples)\n\t\tcount = samples;\n\nwhich does not constrain count on the flush-all path (samples == 0), and\nleaves it well above 32 whenever samples is larger. count samples are\nthen transferred into buffer[]:\n\n\tbmc150_accel_fifo_transfer(data, (u8 *)buffer, count);\n\nbmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a\nmalfunctioning, malicious or counterfeit accelerometer (or an attacker\ntampering with the I2C/SPI bus) that reports up to 127 frames writes up\nto 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up\nto 570 bytes that clobbers the stack canary, saved registers and the\nreturn address.\n\nClamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]\nis sized for, before the transfer, mirroring the watermark clamp already\ndone in bmc150_accel_set_watermark(). A well-formed flush reports at most\nBMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:58.887Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b"
},
{
"url": "https://git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5"
},
{
"url": "https://git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff"
},
{
"url": "https://git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc"
},
{
"url": "https://git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721"
},
{
"url": "https://git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521"
},
{
"url": "https://git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175"
},
{
"url": "https://git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb"
}
],
"title": "iio: accel: bmc150: clamp the device-reported FIFO frame count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64504",
"datePublished": "2026-07-25T08:51:58.887Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:58.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64503 (GCVE-0-2026-64503)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()
but returns -EINVAL directly when a scale with a non-zero integer part is
requested, skipping the matching pm_runtime_put_autosuspend(). This leaks
a runtime PM usage-counter reference on every such write, after which the
device can no longer autosuspend.
Set the error code and fall through to the existing put instead of
returning early.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20
(git)
Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 191fcfeb729ededd8dd2a999c6bf351ddfa0cec7 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 36154171385a8a2444a4b3c6eaa0c5294cb02478 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 223703d6e8bed50b6a0b47e160877909518d94b9 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 6293211d142605bec435229ef0aa3668b8964164 (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 13a91e8631cfeb68e5b7fd6687f194f5a86e83fe (git) Affected: 9a9a369d6178dd4e263c49085ce1b37e1e8f63a0 , < 44a5fd874bb6873bdaec59f722c1d57832fbc9df (git) |
|
| Linux | Linux |
Affected:
4.9
Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/kxsd9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "191fcfeb729ededd8dd2a999c6bf351ddfa0cec7",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "36154171385a8a2444a4b3c6eaa0c5294cb02478",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "223703d6e8bed50b6a0b47e160877909518d94b9",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "6293211d142605bec435229ef0aa3668b8964164",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "13a91e8631cfeb68e5b7fd6687f194f5a86e83fe",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
},
{
"lessThan": "44a5fd874bb6873bdaec59f722c1d57832fbc9df",
"status": "affected",
"version": "9a9a369d6178dd4e263c49085ce1b37e1e8f63a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/kxsd9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kxsd9: fix runtime PM imbalance on write_raw() error\n\nkxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()\nbut returns -EINVAL directly when a scale with a non-zero integer part is\nrequested, skipping the matching pm_runtime_put_autosuspend(). This leaks\na runtime PM usage-counter reference on every such write, after which the\ndevice can no longer autosuspend.\n\nSet the error code and fall through to the existing put instead of\nreturning early."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:58.186Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20"
},
{
"url": "https://git.kernel.org/stable/c/eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc"
},
{
"url": "https://git.kernel.org/stable/c/191fcfeb729ededd8dd2a999c6bf351ddfa0cec7"
},
{
"url": "https://git.kernel.org/stable/c/36154171385a8a2444a4b3c6eaa0c5294cb02478"
},
{
"url": "https://git.kernel.org/stable/c/223703d6e8bed50b6a0b47e160877909518d94b9"
},
{
"url": "https://git.kernel.org/stable/c/6293211d142605bec435229ef0aa3668b8964164"
},
{
"url": "https://git.kernel.org/stable/c/13a91e8631cfeb68e5b7fd6687f194f5a86e83fe"
},
{
"url": "https://git.kernel.org/stable/c/44a5fd874bb6873bdaec59f722c1d57832fbc9df"
}
],
"title": "iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64503",
"datePublished": "2026-07-25T08:51:58.186Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:58.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64502 (GCVE-0-2026-64502)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
ad_sigma_delta_clear_pending_event() falls through to the status register
read path for devices with has_registers = false and no rdy_gpiod. For
such devices, ad_sd_read_reg() skips the address byte entirely and clocks
raw MISO bytes with no address phase — making it byte-for-byte identical
to reading conversion data. If a pending conversion result is present,
this partially consumes it and corrupts the data stream for the subsequent
ad_sd_read_reg() call in ad_sigma_delta_single_conversion().
Furthermore, with num_resetclks = 0 on these devices, data_read_len
evaluates to 0. If the clocked byte has bit 7 clear, pending_event is set
and the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to
SIZE_MAX and corrupting the heap.
Fix by returning 0 immediately when neither rdy_gpiod nor has_registers
is set. This is safe for all current registerless devices: ad7191 and
ad7780 (with powerdown GPIO) are reset between conversions by CS
deassertion, so there is no stale result to drain; ad7780 (without
powerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY
at the output data rate regardless of whether the previous result was
read, so the next falling edge fires naturally.
A future registerless device that holds ~DRDY asserted until data is read
would be broken by this early return and would require either
num_resetclks set or a rdy-gpio.
The same heap corruption is reachable on any device with rdy_gpiod set
but num_resetclks = 0: if the GPIO indicates a pending event, the drain
path executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.
Add an explicit data_read_len == 0 guard after the pending event check;
the stale result is then consumed by the first ad_sd_read_reg() call in
ad_sigma_delta_single_conversion().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
132d44dc6966c1cf841ffe0f6f048165687e870b , < 3394e0b3328422431cadaf314fa58d3717ed4936
(git)
Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < 3bceb26dfaf7ba805b459e41c1d0ba916862dade (git) Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < 91bc6767a4f55dc470d8a56b55b9f2ea09094efe (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ad_sigma_delta.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3394e0b3328422431cadaf314fa58d3717ed4936",
"status": "affected",
"version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
"versionType": "git"
},
{
"lessThan": "3bceb26dfaf7ba805b459e41c1d0ba916862dade",
"status": "affected",
"version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
"versionType": "git"
},
{
"lessThan": "91bc6767a4f55dc470d8a56b55b9f2ea09094efe",
"status": "affected",
"version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ad_sigma_delta.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices\n\nad_sigma_delta_clear_pending_event() falls through to the status register\nread path for devices with has_registers = false and no rdy_gpiod. For\nsuch devices, ad_sd_read_reg() skips the address byte entirely and clocks\nraw MISO bytes with no address phase \u2014 making it byte-for-byte identical\nto reading conversion data. If a pending conversion result is present,\nthis partially consumes it and corrupts the data stream for the subsequent\nad_sd_read_reg() call in ad_sigma_delta_single_conversion().\n\nFurthermore, with num_resetclks = 0 on these devices, data_read_len\nevaluates to 0. If the clocked byte has bit 7 clear, pending_event is set\nand the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to\nSIZE_MAX and corrupting the heap.\n\nFix by returning 0 immediately when neither rdy_gpiod nor has_registers\nis set. This is safe for all current registerless devices: ad7191 and\nad7780 (with powerdown GPIO) are reset between conversions by CS\ndeassertion, so there is no stale result to drain; ad7780 (without\npowerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY\nat the output data rate regardless of whether the previous result was\nread, so the next falling edge fires naturally.\n\nA future registerless device that holds ~DRDY asserted until data is read\nwould be broken by this early return and would require either\nnum_resetclks set or a rdy-gpio.\n\nThe same heap corruption is reachable on any device with rdy_gpiod set\nbut num_resetclks = 0: if the GPIO indicates a pending event, the drain\npath executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.\nAdd an explicit data_read_len == 0 guard after the pending event check;\nthe stale result is then consumed by the first ad_sd_read_reg() call in\nad_sigma_delta_single_conversion()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:57.477Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3394e0b3328422431cadaf314fa58d3717ed4936"
},
{
"url": "https://git.kernel.org/stable/c/3bceb26dfaf7ba805b459e41c1d0ba916862dade"
},
{
"url": "https://git.kernel.org/stable/c/91bc6767a4f55dc470d8a56b55b9f2ea09094efe"
}
],
"title": "iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64502",
"datePublished": "2026-07-25T08:51:57.477Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:57.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64501 (GCVE-0-2026-64501)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and
disable_one() were called from the out: block while keep_cs_asserted
was still true. This caused any SPI transfer issued by those callbacks
to carry cs_change=1, leaving CS permanently asserted after the
conversion. Fix by moving both calls into the out_unlock: block, after
keep_cs_asserted is cleared, matching the pattern already used in
ad_sd_calibrate().
In the error path of ad_sd_buffer_postenable(), if an operation fails
after set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.
spi_offload_trigger_enable()), the device is left in continuous
conversion mode with CS physically asserted. Additionally,
bus_locked remaining true after spi_bus_unlock() causes subsequent
SPI operations to call spi_sync_locked() without the bus lock actually
held, allowing concurrent SPI access.
Fix the error path by clearing keep_cs_asserted first, then calling
set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,
then clearing bus_locked before releasing the bus.
For devices that implement neither set_mode nor disable_one (such as
MAX11205, which has no physical CS pin), no SPI transfer is issued
during cleanup and the cs_change flag has no effect on any physical
line.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
132d44dc6966c1cf841ffe0f6f048165687e870b , < c313bb7c38855e94ceef939d152dd75e5a904b5f
(git)
Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < f1de829ee87a1198d3465493ce430d36c5fa029c (git) Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < c72da0688575e5ef39c36bb44fed53aa18f8ae65 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ad_sigma_delta.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c313bb7c38855e94ceef939d152dd75e5a904b5f",
"status": "affected",
"version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
"versionType": "git"
},
{
"lessThan": "f1de829ee87a1198d3465493ce430d36c5fa029c",
"status": "affected",
"version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
"versionType": "git"
},
{
"lessThan": "c72da0688575e5ef39c36bb44fed53aa18f8ae65",
"status": "affected",
"version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ad_sigma_delta.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix CS held asserted and state leaks\n\nIn ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and\ndisable_one() were called from the out: block while keep_cs_asserted\nwas still true. This caused any SPI transfer issued by those callbacks\nto carry cs_change=1, leaving CS permanently asserted after the\nconversion. Fix by moving both calls into the out_unlock: block, after\nkeep_cs_asserted is cleared, matching the pattern already used in\nad_sd_calibrate().\n\nIn the error path of ad_sd_buffer_postenable(), if an operation fails\nafter set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.\nspi_offload_trigger_enable()), the device is left in continuous\nconversion mode with CS physically asserted. Additionally,\nbus_locked remaining true after spi_bus_unlock() causes subsequent\nSPI operations to call spi_sync_locked() without the bus lock actually\nheld, allowing concurrent SPI access.\n\nFix the error path by clearing keep_cs_asserted first, then calling\nset_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,\nthen clearing bus_locked before releasing the bus.\n\nFor devices that implement neither set_mode nor disable_one (such as\nMAX11205, which has no physical CS pin), no SPI transfer is issued\nduring cleanup and the cs_change flag has no effect on any physical\nline."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:56.768Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c313bb7c38855e94ceef939d152dd75e5a904b5f"
},
{
"url": "https://git.kernel.org/stable/c/f1de829ee87a1198d3465493ce430d36c5fa029c"
},
{
"url": "https://git.kernel.org/stable/c/c72da0688575e5ef39c36bb44fed53aa18f8ae65"
}
],
"title": "iio: adc: ad_sigma_delta: fix CS held asserted and state leaks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64501",
"datePublished": "2026-07-25T08:51:56.768Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:56.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64500 (GCVE-0-2026-64500)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51
VLAI
EPSS
VEX
Title
iio: adc: lpc32xx: Initialize completion before requesting IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: lpc32xx: Initialize completion before requesting IRQ
In the report from Jaeyoung Chung:
"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in lpc32xx_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
lpc32xx_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 7090c0d29708ee305022d0ea7b37612b33242fa2
(git)
Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 0e33587967b356519aa6f220b5b43c6976320397 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 820c4f15353efe9a9429ae86ccceeaf4e0e4e585 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 48eccc6caed4e62c0f199ab3a3772fa969cd3b2d (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < 2f18c5551aa97ca7f39dbb151c67c9053ccadc17 (git) Affected: 7901b2a1453e48c9defff2c97c67d3089bf4df7a , < e561b35633f450ee607e87a6401d97f156a0cd54 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/lpc32xx_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7090c0d29708ee305022d0ea7b37612b33242fa2",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "0e33587967b356519aa6f220b5b43c6976320397",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "820c4f15353efe9a9429ae86ccceeaf4e0e4e585",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "48eccc6caed4e62c0f199ab3a3772fa969cd3b2d",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "2f18c5551aa97ca7f39dbb151c67c9053ccadc17",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
},
{
"lessThan": "e561b35633f450ee607e87a6401d97f156a0cd54",
"status": "affected",
"version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/lpc32xx_adc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: lpc32xx: Initialize completion before requesting IRQ\n\nIn the report from Jaeyoung Chung:\n\n\"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its\ninterrupt handler with devm_request_irq() before it initializes\nst-\u003ecompletion with init_completion(). If an interrupt arrives after\ndevm_request_irq() and before init_completion(), the handler calls\ncomplete() on an uninitialized completion, causing a kernel panic.\n\nThe probe path, in lpc32xx_adc_probe():\n\n iodev = devm_iio_device_alloc(\u0026pdev-\u003edev, sizeof(*st)); /* st kzalloc-zeroed */\n ...\n retval = devm_request_irq(\u0026pdev-\u003edev, irq, lpc32xx_adc_isr, 0,\n LPC32XXAD_NAME, st); /* register handler */\n ...\n init_completion(\u0026st-\u003ecompletion); /* initialize completion */\n\nlpc32xx_adc_isr() calls complete():\n\n complete(\u0026st-\u003ecompletion);\n\nIf the device raises an interrupt before init_completion() runs,\ncomplete() acquires the uninitialized wait.lock and walks the zeroed\ntask_list in swake_up_locked(). The zeroed task_list makes list_empty()\nreturn false, so swake_up_locked() dereferences a NULL list entry,\ntriggering a KASAN wild-memory-access.\"\n\nFix the chance of a spurious IRQ causing an uninitialized pointer\ndereference by moving init_completion() above devm_request_irq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:51:56.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7090c0d29708ee305022d0ea7b37612b33242fa2"
},
{
"url": "https://git.kernel.org/stable/c/0e33587967b356519aa6f220b5b43c6976320397"
},
{
"url": "https://git.kernel.org/stable/c/1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd"
},
{
"url": "https://git.kernel.org/stable/c/820c4f15353efe9a9429ae86ccceeaf4e0e4e585"
},
{
"url": "https://git.kernel.org/stable/c/48eccc6caed4e62c0f199ab3a3772fa969cd3b2d"
},
{
"url": "https://git.kernel.org/stable/c/9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4"
},
{
"url": "https://git.kernel.org/stable/c/2f18c5551aa97ca7f39dbb151c67c9053ccadc17"
},
{
"url": "https://git.kernel.org/stable/c/e561b35633f450ee607e87a6401d97f156a0cd54"
}
],
"title": "iio: adc: lpc32xx: Initialize completion before requesting IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64500",
"datePublished": "2026-07-25T08:51:56.053Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-07-25T08:51:56.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}